Task verbs tell you what a free-response part is asking you to do. On the AP Cybersecurity Exam, the single free-response question is a Device Security Analysis prompt. This guide breaks down the five task verbs commonly used in AP Cybersecurity free-response questions so you can match your response to what each part asks.
Where Task Verbs Show Up
The free-response section is one Device Security Analysis question worth 30% of your exam score, with a suggested time of 50 minutes. It gives you multiple simulated sources about the same digital device. Sources may include broad categories such as security policies, firewall configurations, file-system permissions, and log files.
The question asks you to analyze provided sources to identify security issues, detect evidence of attacks, describe how configuration or permission changes affect the device and users, and evaluate how security controls influence network traffic and device behavior. Students are expected to cite evidence from the provided sources and explain their reasoning when describing attacks, permission settings, or the impact of policy or configuration modifications. The task verbs control the shape of each part, so reading them carefully is your first move.
The Five CED Task Verbs
Here is what each commonly used free-response verb asks you to do.
| Task Verb | What it asks | What your answer needs |
|---|---|---|
| Identify | Provide information about cybersecurity concepts or evidence from the given sources | A direct answer or a specific source citation, no extended reasoning |
| Describe | Provide information about a cybersecurity process or outcome | Details about how a process works or what an outcome looks like |
| Determine | Provide a specific result by applying appropriate criteria or reasoning to the sources | A clear conclusion supported by the criteria you applied |
| Explain | Provide reasons that support a solution or account for how an outcome occurs, using specific evidence | A claim plus the why, validated with evidence from the sources |
| Write | Express in print form a proper command that has the indicated effect | A correctly formatted command that produces the stated effect |
How Each Verb Changes Your Response
Identify is the lightest lift. You are pulling a fact or pointing to evidence. If a prompt says identify the log entry that shows a failed login, you cite the entry. You do not need to explain why it matters unless a later part asks.
Describe asks you to lay out a process or outcome. It wants the how or the what, not a justification. Describing how a firewall rule filters traffic means walking through what the rule does step by step.
Determine wants a specific result that you reached by reasoning over the sources. You apply criteria, then state the conclusion. The key is showing that your answer follows from the evidence, not from a guess.
Explain is the heaviest reasoning verb. You must give the reasons behind a solution or outcome and back them with specific evidence. An explain answer that just states a fact without the why is incomplete.
Write is unique because it expects an actual command in print form. The command has to be correct and produce the indicated effect in the source context the prompt gives you.
Worked Mini-Example
Imagine the prompt gives you an /var/log/auth.log excerpt showing repeated failed SSH logins from one IP, followed by a successful login.
A part that says Identify the evidence of a possible brute-force attempt wants a citation:
The repeated Failed password entries from IP 203.0.113.45 across a short time window show repeated failed authentication attempts.
A part that says Explain how this evidence indicates an attack needs reasoning plus evidence:
The high volume of Failed password entries from a single source IP, followed by an Accepted password entry, indicates a brute-force attack that eventually succeeded. The pattern of many failures then one success matches an adversary guessing credentials until one works, which is why the successful login is suspicious rather than routine.
A part that says Determine the appropriate firewall action wants a reasoned result:
Because the attempts originate from 203.0.113.45, blocking inbound traffic from that source IP is the appropriate control, since it stops further authentication attempts from the attacking host.
A part that says Write a command wants the actual command. Use only the defensive command and artifact types supported by the sources, such as adjusting a firewall rule or file permission. For example, if the prompt supplies an iptables-style firewall context:
</>Codeiptables -A INPUT -s 203.0.113.45 -j DROP
Notice how the same scenario produced four very different answers. The verb, not the topic, decided the format.
A Quick Workflow for Each FRQ Part
- Underline the task verb before you read anything else in the part.
- If it is identify or describe, plan a direct, factual answer and skip extra reasoning.
- If it is determine, decide what criteria the sources support, then state your result.
- If it is explain, write your claim, then attach evidence and the reason it matters.
- If it is write, draft the exact command and check that its effect matches the prompt.
- For every part except a pure command, quote or reference a specific source artifact.
Common Mistakes to Avoid
Explaining when you were only asked to identify. Padding an identify answer wastes your limited 50 minutes. Give the fact and move on.
Identifying when you were asked to explain. This is the more costly error. If you state evidence but never give the reasoning, an explain part stays unfinished. Always pair your claim with the why.
Forgetting to cite sources. The prompt expects evidence from the provided artifacts. Vague answers that never reference a specific log line, firewall rule, or permission string leave reasoning unsupported.
Writing prose instead of a command. When the verb is write, the reader wants a proper command in print form, not a sentence describing what a command would do.
Inventing facts the sources do not show. Determine and explain answers must follow from the given sources. Do not assume an attack succeeded, a port is open, or a user has access unless an artifact supports it.
Mismatching the command to its stated effect. For write tasks, reread the indicated effect and confirm your command actually causes it. A command that blocks the wrong IP or changes the wrong permission does not satisfy the prompt.
Putting It Together
Treat the task verb as the instruction manual for each part. Identify and describe are factual and fast, determine produces a reasoned result, explain demands claim plus evidence plus reasoning, and write demands a correct command. Match your response shape to the verb every single time, ground your answers in the supplied sources, and you will spend your 50 minutes earning credit instead of writing the wrong kind of answer.
Frequently Asked Questions
What are the task verbs on the AP Cybersecurity free-response question?
The CED lists five task verbs: identify, explain, describe, determine, and write.
How is explain different from identify on the AP Cybersecurity exam?
Identify just wants a fact or a specific citation from the sources with no extended reasoning. Explain wants a claim plus the reasons behind it, validated with specific evidence from the sources.
What does the write task verb require on the AP Cybersecurity FRQ?
Write means you express a proper command in print form that produces the indicated effect.
Where do task verbs appear on the AP Cybersecurity exam?
Task verbs structure the single free-response question, the Device Security Analysis prompt, which is worth 30% of your score with a 50-minute suggested time.