AP Cybersecurity technical skills cover the hands-on tasks you must perform on the exam: reading and writing commands, interpreting file permissions, tracing firewall rules, and analyzing network diagrams. These are not background knowledge questions but applied tasks where exact syntax, rule order, and diagram interpretation determine whether your response earns credit.
Use the five topic guides below to practice each skill area before your exam.
AP Cybersecurity tests technical skills differently from most AP courses. Instead of explaining what a firewall does in general, you are given an ACL and asked which packets are allowed. Instead of defining encryption, you are given a command and asked what it produces or asked to write the correct command yourself. Precision matters at every step.
When a free-response prompt uses the verb Write, you must produce exact command syntax. This includes chmod with symbolic or numeric notation, openssl commands for symmetric and asymmetric encryption, RSA key generation, and hash verification. Reading command output as evidence is also tested, so you need to know what correct and incorrect output looks like.
File permissions and firewall ACL rules both require you to trace who can do what and why. For permissions, you read ls -l and getfacl output, then apply chmod to reach a target state. For firewalls, you trace a packet through an ordered rule set and determine whether it is allowed or denied, then write or modify rules to meet a scenario's requirements.
Network diagrams are evidence, not illustrations. You identify firewall placement, DMZ structure, segmentation choices, and trust boundaries, then connect those layout decisions to specific risks or controls. The exam expects you to explain why a device's position in the diagram matters, not just label what it is.
Every technical task on this exam rewards specificity. A chmod command with the wrong octet, a firewall rule with the wrong port, or a diagram interpretation that ignores a trust boundary will not earn full credit. Practice by working through each command and rule set step by step, checking your output against what the scenario actually requires.
Covers chmod, openssl, hashing, ls -l, and getfacl with exact syntax. Use this guide to practice both reading command output as evidence and writing commands that produce a required effect.
Walks through symmetric encryption, RSA key generation, and hash verification with worked examples. Focuses on what each command does, what input and output to expect, and when each is the right tool.
Teaches you to read ls -l and getfacl output, apply symbolic and numeric chmod, and connect permission analysis to the Device Security Analysis free-response question.
Explains how to trace a packet through an ordered ACL, identify which rule applies, and write or modify rules to meet a scenario's traffic requirements. Covers default deny and rule order logic.
Teaches you to read diagrams as security evidence: firewall placement, DMZ structure, segmentation, and trust boundaries. Connects layout decisions to specific risks and controls.
The exam distinguishes between two command tasks. Read tasks give you a command or its output and ask you to interpret what it does or what it reveals about a device's security state. Write tasks require you to produce a syntactically correct command that achieves a stated effect. Both appear in free-response and multiple-choice contexts.
| Task verb | What you must do | Where it appears |
|---|---|---|
| Write | Produce exact command syntax that achieves the stated effect | Free-response Device Security Analysis |
| Read | Interpret a command or its output as evidence about security state | Multiple-choice and free-response |
| Modify | Change an existing command or rule to meet new requirements | Free-response firewall and permission tasks |
File permissions on Linux control read (r), write (w), and execute (x) access for three categories: owner, group, and other. The exam tests whether you can read a permission string, identify a security problem, and apply the correct chmod command to fix it. Both ls -l and getfacl output appear as evidence in Device Security Analysis scenarios.
| Notation | Example | Meaning |
|---|---|---|
| Symbolic | chmod o-rwx file | Remove all permissions from other |
| Numeric | chmod 640 file | Owner rw, group r, other none |
| getfacl output | user:alice:r-- | Named user alice has read-only access via ACL entry |
Firewall ACL rules are evaluated in order, and the first matching rule wins. The exam gives you a rule set and a packet description, then asks whether the packet is allowed or denied and why. You may also need to write a new rule or identify which existing rule is causing an unintended effect. Default deny means any packet not matched by an explicit allow rule is blocked.
| Rule component | What to check | Common error |
|---|---|---|
| Source IP | Does the packet's source match the rule's source range? | Using the wrong subnet mask or confusing source and destination |
| Destination port | Does the packet's destination port match exactly? | Allowing port 80 when the scenario requires 443 |
| Protocol | Is the protocol TCP or UDP as specified? | Writing a TCP rule when the service uses UDP |
| Rule position | Is a more specific rule placed before a broader one? | Placing a deny-all before the intended allow rules |
Network diagrams on the exam are not decoration. Each device placement, connection, and boundary communicates something about risk and controls. You need to identify where firewalls sit relative to traffic flow, what a DMZ isolates and why, how segmentation limits lateral movement, and what trust boundaries separate zones. Then you connect those observations to specific security implications.
| Diagram feature | Security implication | Exam question type |
|---|---|---|
| Firewall between internet and DMZ | Filters inbound traffic before it reaches public-facing servers | Identify the control and explain its effect |
| No firewall between DMZ and internal LAN | A compromised DMZ server can reach internal resources directly | Identify the vulnerability and recommend a fix |
| Flat network with no segmentation | Lateral movement is unrestricted once an attacker is inside | Explain the risk and describe a segmentation solution |
Cryptography command tasks require you to know which tool to use for which purpose, what the correct syntax looks like, and what the output means. Symmetric encryption uses a shared key and is faster but requires secure key exchange. Asymmetric encryption uses a key pair and solves the key distribution problem. Hashing verifies integrity but does not encrypt data.
| Goal | Tool | Key concept |
|---|---|---|
| Encrypt a file with a shared password | openssl enc with a symmetric cipher | Both parties must already share the key securely |
| Encrypt so only the recipient can decrypt | openssl with recipient's RSA public key | Recipient decrypts with their private key |
| Verify a file has not been modified | sha256sum and compare to stored hash | Hash mismatch means the file changed |
Numeric chmod digits go owner, group, other in that order. Writing 467 instead of 764 reverses the intended permissions. Always map each digit to its category before writing the command.
Students often match a packet to a rule that shares one attribute (same port) but does not match all required fields (source IP, protocol). A rule only matches when every field in that rule matches the packet. Keep checking until all fields align.
Hashing is not encryption. A hash cannot be reversed to recover the original file, and it does not protect confidentiality. Using sha256sum when the task requires confidentiality, or using openssl enc when the task requires integrity verification, will not earn credit.
Saying a firewall is between the internet and the DMZ describes the diagram. Explaining that this placement filters inbound traffic before it reaches public-facing servers analyzes it. Exam responses that only describe layout without stating the security implication score lower.
If a packet does not match any explicit rule, it hits the default deny and is blocked. Students who conclude a packet is allowed because no deny rule explicitly names it are missing the implicit deny-all at the end of the rule set.
This is the primary location where technical skills are scored. You will be given a scenario that may include a network diagram, file permission output, firewall ACL, or command to interpret. Tasks use verbs like Write, Identify, Explain, and Modify. Exact syntax and specific security reasoning are required for full credit.
Multiple-choice questions present permission strings, ACL rule sets, network diagrams, or command outputs as the stimulus. You must interpret the technical evidence to select the correct answer. These items test the same read skills as the free-response question but in a selected-response format.
Network diagrams and firewall rules map to Unit 3 (Securing Networks) and Unit 4 (Securing Devices). File permissions and cryptography commands map to Unit 4 and Unit 5 (Securing Applications and Data). Technical skill tasks on the exam are always grounded in these unit contexts, so knowing which skill belongs to which defensive domain helps you interpret scenario prompts correctly.
Open the individual guides for Cybersecurity Technical Skills when you want a closer review of one topic.
browse guidesAP Cybersecurity tests your ability to read and write firewall ACL rules, interpret file permissions, run command-line tools like chmod and openssl, analyze network diagrams, and apply cryptography commands. These skills appear in both multiple-choice scenario items and the free-response Device Security Analysis question.
The Device Security Analysis is a free-response question that gives you several sources from one device, such as firewall configurations, file-permission strings, and log files. You analyze those sources to identify security problems, explain how configurations affect users, and write proper commands or rule changes to fix the issues.
Firewall ACL rules are evaluated in order from top to bottom. Each rule specifies a source IP, destination IP, port, protocol, and an allow or deny action. The first rule that matches a packet applies, and most rule sets end with a default deny that blocks any traffic not explicitly permitted.
The key commands are chmod for setting file permissions, ls -l and getfacl for reading permissions, and openssl for encrypting, decrypting, generating RSA key pairs, and verifying file hashes. Free-response Write tasks require exact syntax, so practicing the full command structure matters more than memorizing definitions.
Linux file permissions control read, write, and execute access for three groups: the owner, the group, and all other users. The ls -l command displays a permission string like -rwxr, r, and chmod changes those permissions using either symbolic notation (u+x) or numeric notation (755).
AP Cybersecurity covers symmetric encryption with shared keys, asymmetric encryption using RSA key pairs, and hash-based file integrity verification. The focus is on applying openssl commands correctly: knowing which flags to use, what input each command expects, and when to choose symmetric versus asymmetric encryption for a given scenario.