This collection brings together two scenario-focused guides that build the decision-making skills AP Cybersecurity tests most directly: risk assessment and AI-assisted analysis. Use these resources when you need to practice moving from a raw scenario to a reasoned, documented response.
Start with the Risk Assessment Guide to build your core workflow, then layer in the AI in Scenario Practice Guide to handle prompts where AI tools are part of the situation.
AP Cybersecurity scenario prompts ask you to do more than recall definitions. You need to identify assets, spot vulnerabilities, evaluate threats, weigh likelihood and impact, recommend mitigations, and document your reasoning. These two guides give you a repeatable process for exactly that, whether the scenario involves a physical access control failure, a network intrusion, or an AI-assisted detection tool.
Covers the Skill Category 1 workflow step by step. You move from identifying assets and vulnerabilities to writing a risk statement and recommending mitigations. The core logic, risk occurs when a threat exploits a vulnerability to compromise an asset, applies to every unit in the course.
Focuses on the decision-making layer that appears when AI is present in a scenario. Covers how AI assists with risk identification, mitigation recommendations, attack detection, and collaboration, and flags the common trap of treating AI output as automatically correct.
The AI guide is explicitly built on top of the risk assessment workflow. It does not re-explain how adversaries use AI (Topic 1.4) or how defenders use AI tools (Topic 1.5). Instead, it shows you how to apply your risk reasoning when AI is a variable in the scenario.
Both guides are designed around the same insight: the specific domain of a scenario, physical security, network defense, data privacy, changes the details but not the reasoning structure. If you can work through the risk assessment workflow fluently and adjust for AI involvement when it appears, you can handle scenario prompts across all AP Cybersecurity units.
Build the core Skill Category 1 workflow. This guide covers assets, vulnerabilities, threats, likelihood, impact, mitigation, and documentation with a step-by-step process you can apply to any scenario domain in the course.
Add the AI reasoning layer. This guide focuses on scenarios where AI tools are part of the situation, covering risk identification, mitigation, detection, and collaboration, and the critical trap of over-trusting AI output.
This guide walks you through the full Skill Category 1 process from scenario to documented risk statement. It is the foundational resource in this collection and the right starting point for any student who wants a repeatable method for scenario prompts.
| Step | What you produce | Common error |
|---|---|---|
| Asset identification | Named asset with its value stated | Listing everything instead of the asset at risk in this scenario |
| Vulnerability analysis | Specific weakness, not a general category | Writing 'poor security' instead of naming the actual gap |
| Threat identification | Named threat actor or event | Confusing the threat with the vulnerability |
| Likelihood and impact | Justified ratings, not just high or low | Skipping justification and just labeling the risk |
| Mitigation recommendation | Control tied to the specific vulnerability | Recommending generic best practices unconnected to the scenario |
This guide addresses the decision-making you need when a scenario includes AI tools on either side of a security situation. It is designed to be used after you have the core risk workflow down, adding a layer of critical evaluation for AI output and AI-assisted processes.
| Scenario element | What AI can assist with | What still requires human judgment |
|---|---|---|
| Risk identification | Surfacing patterns and anomalies at scale | Determining whether a flagged item is actually a risk in this context |
| Mitigation selection | Generating candidate controls based on known vulnerabilities | Evaluating whether a control fits the organization's constraints |
| Attack detection | Classifying traffic or behavior against trained models | Investigating alerts and ruling out false positives |
| Documentation | Drafting risk statements from structured inputs | Verifying accuracy and adding scenario-specific nuance |
A vulnerability is a weakness in a system or process. A threat is the actor or event that could exploit that weakness. Writing 'the threat is unpatched software' conflates the two and will cost you points on scenario prompts.
Labeling a risk as high without connecting that rating to specific scenario details, such as the sensitivity of the data or the attacker's access level, is incomplete analysis. The Risk Assessment Guide emphasizes that justified ratings are part of the workflow.
The AI in Scenario Practice Guide flags this as the primary trap in AI-involved scenarios. AI tools can surface patterns and generate recommendations, but they require human verification before any action is taken.
A mitigation recommendation earns credit when it directly addresses the specific vulnerability in the scenario. Recommending a firewall for a social engineering scenario, for example, does not demonstrate scenario-specific reasoning.
The core risk logic, threat exploiting a vulnerability to compromise an asset, applies to physical security, data privacy, supply chain, and every other domain in the course. Both guides are designed to transfer across all units.
Both guides are built around this skill category. Scenario prompts that ask you to identify risks, evaluate vulnerabilities, or recommend mitigations are testing your ability to apply the risk assessment workflow the Risk Assessment Guide teaches.
The AI in Scenario Practice Guide connects to Topic 1.4 (adversarial AI use) and Topic 1.5 (defensive AI tools) without re-teaching them. On exam scenarios where AI is present, you need to reason about its role and limitations, not just identify that it exists.
AP Cybersecurity scenarios can draw from any unit, physical security, network defense, data privacy, supply chain, or governance. Both guides emphasize that the risk reasoning structure stays constant across domains, which is exactly what the exam tests.
Open the individual guides for Cybersecurity Scenario Practice when you want a closer review of one topic.
browse guidesAP Cybersecurity scenario practice is the process of applying course skills to realistic security situations, such as identifying risks, recommending mitigations, and analyzing threats across physical spaces, networks, devices, and data. It directly prepares you for the scenario-based questions that appear throughout the AP Cybersecurity exam.
Risk assessment falls under Skill Category 1, Analyze Risk, which accounts for 25 to 40 percent of the multiple-choice section, making it one of the highest-weighted skills on the exam. A repeatable workflow covering assets, vulnerabilities, threats, likelihood, impact, and mitigation applies across every content unit.
AI appears across multiple AP Cybersecurity skill categories, and several course skills explicitly require analysis both with and without AI support. Scenario questions may present AI-assisted findings and ask you to evaluate risk, recommend mitigations, or detect attacks while recognizing that AI output is not automatically correct.
Scenario practice draws on all five units: physical security from Unit 2, network threats from Unit 3, device vulnerabilities from Unit 4, and application or data risks from Unit 5, all anchored by the foundational concepts in Unit 1. The same risk reasoning framework applies regardless of which domain a scenario targets.
Fiveable offers two focused guides on this page: the AP Cybersecurity Risk Assessment Guide, which walks through a step-by-step workflow from raw scenario to documented risk statement, and the AP Cybersecurity AI in Scenario Practice Guide, which covers decision-making when AI-assisted findings appear in a prompt.
Every AP Cybersecurity risk scenario builds on one foundational idea: risk occurs when a threat can exploit a vulnerability to compromise an asset. Internalizing that relationship lets you apply consistent reasoning to any domain, whether the scenario involves a physical space, a network, a device, or stored data.