AP Cybersecurity Detect Attacks is Skill Category 3, the set of skills you use to spot malicious activity after defenses are in place. You monitor systems, set up and choose detection methods, and analyze digital evidence like log files to find and classify attacks. You do this both on your own and with the support of AI tools.

This skill matters because no system is perfectly protected. Even with strong controls, adversaries get in or try to, so defenders need ways to notice signs of compromise quickly and respond. On the exam, this category appears in both the multiple-choice section and the free-response question.

What Detect Attacks Means

Detecting attacks means finding evidence that something malicious is happening or has already happened. You are not just preventing attacks here. You are looking for proof in the data systems generate.

The core evidence you work with is the indicator of compromise (IoC), a sign in logs or system behavior that suggests an attack. Examples include repeated failed login attempts, traffic from unexpected locations, or unusual file changes.

Detection sits at a specific point in defense. Risk analysis (Skill Category 1) and mitigation (Skill Category 2) come first, then detection covers what those layers miss.

What This Skill Requires

To work in this category you need to:

Know what monitoring methods exist and explain how each one surfaces an attack.
Choose appropriate detection strategies for a given system or scenario.
Judge how well a detection method works and what trade-offs it brings.
Read digital evidence, decide whether an attack happened, and label what kind it is.
Use AI as a support tool for faster analysis while still reasoning on your own.

You also need to cite evidence. On the free-response question you are expected to point to specific sources and explain your reasoning, not just state a conclusion.

Subskills You Need

3.A: Identify monitoring methods and explain how they detect attacks

Know the common ways systems are watched and what each one catches.

Log files record events such as logins, network connections, and file access. Reviewing them reveals IoCs.
Intrusion detection systems and automated monitoring flag suspicious patterns in traffic or behavior.
Alerts and audit trails show who did what and when.

For each method, be ready to explain the mechanism. Example: an authentication log detects a brute-force attempt because it records many failed logins in a short window from one source.

3.B: Determine strategies and methods to detect attacks

Given a scenario, pick the right detection approach.

Match the method to the asset. Network attacks call for network log review and traffic monitoring. Device attacks call for authentication and system log review.
Combine signature-based detection (known attack patterns) with behavior-based detection (anything abnormal).
Decide what to monitor and how often based on the value of the asset.

3.C: Evaluate the impact of threat detection methods

Detection methods are not free, and they are not perfect. Weigh the trade-offs.

False positives waste analyst time and can cause alert fatigue.
False negatives mean real attacks slip through.
More monitoring can cost performance, storage, and money.
Automated and AI-assisted detection speeds things up but still needs human review.

A good answer names a benefit and a cost, then ties them to the scenario.

3.D: Detect and classify cyberattacks by analyzing digital evidence, with and without AI

This is the hands-on core. Read the evidence, decide an attack occurred, and name the attack type.

Spot the IoC in the source (the failed logins, the odd outbound connection, the injected input).
Classify it. Is this a brute-force attempt, a phishing click, malware execution, or something else?
Explain how the evidence supports your classification.
When AI helps, treat it as a starting point and verify the output against the raw evidence.

How It Shows Up on the AP Exam

Multiple-choice section: All four subskills (3.A, 3.B, 3.C, 3.D) appear in MCQs. Skill Category 3 carries an approximate weighting of 25 to 40 percent of the multiple-choice section. Expect questions that ask which monitoring method fits a situation, what an IoC indicates, or what trade-off a detection method creates.

Free-response question: The single FRQ is a Device Security Analysis task. It gives you simulated sources about one digital device, which may include security policies, firewall configurations, file-system permissions, and log files. The question assesses Skill Categories 2 and 3, so detection is directly tested. You will identify security issues, detect evidence of attacks, and explain how controls affect device and network behavior. The suggested time is 50 minutes.

Watch the task verbs. Identify asks for information, while evaluate and explain ask you to reason and justify with evidence from the sources.

Examples Across the Course

Detection appears in every unit through the "detecting" topics. Here is how the same skill shows up in different domains.

Introduction to Security (phishing logs): In Unit 1 you examine a suspicious email and review log files for signs that a target clicked a malicious link. The IoC might be a connection to an unexpected domain right after the email arrived.
Securing Spaces (physical breaches): In Unit 2 detection shifts to the physical layer. You evaluate controls like cameras and sensors that detect an intruder entering a space, and you judge their impact on coverage.
Securing Networks (traffic analysis): In Unit 3 you analyze network log files for IoCs and use automated tools, including AI, to flag malicious traffic faster. Example: a spike of connections to one internal host could indicate scanning.
Securing Devices (authentication logs): In Unit 4 you review authentication logs for IoCs such as repeated failed logins followed by a success, which suggests a compromised credential.
Securing Applications and Data (application logs): In Unit 5 you check application logs for evidence of attacks like injection attempts, then classify what the attacker tried to do to the data.

Notice the pattern. The evidence source changes, but the workflow stays the same: find the IoC, classify the attack, explain with evidence.

How to Practice Detect Attacks

These are practical study habits, not official rules.

Build a log-reading routine. Pull a sample log and practice finding the one line that is the IoC. Say out loud why it stands out.
Name the attack every time. Do not stop at "this looks suspicious." Classify it: brute force, phishing, malware, injection, or scanning.
Practice citing. For each conclusion, point to the exact source line and write one sentence of reasoning. This matches the FRQ expectation.
Compare methods. For a given scenario, list two detection options and one benefit and one cost of each.
Use AI deliberately. Ask an AI tool to summarize a log, then check its claims against the raw data so you can spot where it is wrong.
Work the Device Security Analysis format. Practice with multiple source types at once: a policy, a firewall config, permissions, and a log, since the FRQ combines them.

Common Mistakes

Confusing detection with prevention. A firewall blocks traffic (mitigation). A log review finds an attack (detection). Know which one a question is asking about.
Stating a conclusion without evidence. "There was an attack" earns little. Cite the source and explain the IoC.
Skipping classification. Detecting that something happened is only half. Name the attack type.
Treating detection as flawless. Forgetting false positives and false negatives misses the point of 3.C.
Over-trusting AI output. AI speeds analysis but can be wrong. Verify against the raw evidence.
Ignoring the asset. The right detection method depends on whether you are watching a network, a device, data, or a physical space.

Quick Review

Detect Attacks (Skill Category 3) covers monitoring, choosing detection methods, evaluating them, and analyzing evidence.
3.A: Know monitoring methods and how they detect attacks.
3.B: Choose the right detection strategy for the scenario.
3.C: Weigh benefits and costs, including false positives and false negatives.
3.D: Analyze digital evidence to detect and classify attacks, with and without AI.
IoC is the central concept: a sign in logs or behavior that points to an attack.
The skill appears in MCQs (25 to 40 percent of that section) and in the Device Security Analysis FRQ, where you must cite evidence from the sources.
Same workflow across units: find the IoC, classify the attack, explain with evidence.