The Device Security Analysis FRQ is the only free-response question on the AP Cybersecurity Exam, and it tests whether you can read logs, policies, firewall configs, and permissions as a connected set rather than isolated documents. These three guides build the exact skills you need: reading sources together, citing log evidence precisely, and writing findings in a structured incident report format.
Use these guides before your exam to practice the cross-referencing and evidence-citation workflow the FRQ rewards.
The Device Security Analysis task gives you several simulated sources about one device and asks you to identify security issues, classify attacks using digital evidence, and recommend mitigations. Strong responses treat the sources as a connected set: a firewall rule that allows unexpected traffic, a log entry showing that traffic arriving, and a policy document that prohibits it all point to the same finding. These guides teach you to make those connections and write them up clearly.
Covers auth, network, application, and nginx access logs. Teaches you which fields matter (timestamps, source IPs, status codes, user agents), how to spot indicators of compromise, and how to turn raw log lines into evidence-based explanations for the FRQ. Directly tied to detection skills 3.D, 4.4.D, and 5.6.E.
Teaches the cross-checking workflow for the Device Security Analysis task. You will learn how to read policies, firewall configurations, permissions, and logs as a connected set, identify where they contradict or confirm each other, and cite evidence in a way that actually earns points rather than just restating the source.
Shows you how to organize raw scenario evidence into a structured report: findings, evidence, risk, impact, recommended mitigation, and follow-up. This is the format the FRQ expects and the format used in workplace-style scenarios across Units 3, 4, and 5.
The Device Security Analysis FRQ is designed so that no single source tells the whole story. A log entry alone does not prove an attack; a firewall rule alone does not prove a misconfiguration. The exam rewards students who connect evidence across sources and explain what the combination means for the device and its users. Every guide in this collection builds toward that skill.
Begin with this guide if you are unsure how to read log files or which fields to focus on. It covers the four log types most likely to appear in the Device Security Analysis scenario and teaches you how to spot indicators of compromise and cite them precisely.
Use this guide to practice the cross-referencing workflow. It is most useful after you can read individual logs and are ready to connect evidence across multiple source types into a single coherent finding.
Use this guide last to practice structuring your findings into the six-part report format the FRQ expects. It is especially useful for students who understand the security issues but lose points because their written responses are disorganized or incomplete.
The log analysis guide focuses on four log types you are likely to see in the Device Security Analysis scenario: authentication logs, network logs, application logs, and nginx access logs. For each type, you need to identify the meaningful fields and explain what an anomalous value indicates.
| Log type | Key fields to check | Common IoC pattern |
|---|---|---|
| Auth log | Username, timestamp, success/failure, source IP | Many failures then one success from same IP |
| Network log | Source IP, destination port, protocol, bytes | Unexpected outbound traffic on unusual port |
| Application log | Endpoint, method, response code, user agent | Repeated 404s or access to admin paths |
| Nginx access log | IP, request path, status code, referrer | Scanning pattern across many paths in short window |
The source analysis guide gives you a workflow for the Device Security Analysis task. Before writing any finding, read all sources and mark where they overlap or contradict. A firewall rule permitting port 22 from any IP, combined with an auth log showing SSH login attempts from an external address, is a stronger finding than either source alone.
| Weak response | Strong response |
|---|---|
| 'The log shows suspicious activity.' | 'Auth log line 47 shows five failed SSH attempts from 203.0.113.4 between 02:14 and 02:15, followed by a successful login at 02:16, indicating a successful brute force attack.' |
| 'The firewall rules are misconfigured.' | 'Firewall rule 3 permits inbound traffic on port 22 from any source (0.0.0.0/0), which contradicts the network policy requiring SSH access to be restricted to the internal subnet 10.0.0.0/24.' |
The incident report guide teaches you the six-part structure the Device Security Analysis FRQ expects: finding, evidence, risk, impact, recommended mitigation, and follow-up. Each section has a specific job. Skipping risk or impact is a common reason students lose points even when their evidence is correct.
| Report section | What to include | What to avoid |
|---|---|---|
| Finding | Specific vulnerability or attack type with source reference | Vague language like 'there is a problem with the account' |
| Evidence | Exact field, value, or line from the source | Paraphrasing the whole source without a specific cite |
| Mitigation | Concrete change to config, permission, or policy | Generic advice like 'improve security practices' |
Students who read each source independently miss the connections the FRQ is designed to test. A log entry and a firewall rule that point to the same issue together constitute a finding; either one alone is just an observation.
Writing 'the log shows suspicious activity' does not earn evidence points. You need to name the specific field, value, timestamp, or line that proves your claim.
Students often write a strong finding and mitigation but omit risk and impact because they feel redundant. These sections have separate scoring weight and require you to explain consequences, not just describe the issue.
Phrases like 'update the firewall' or 'improve access controls' do not demonstrate understanding. A strong mitigation names the specific rule, permission, or setting to change and explains why that change addresses the identified risk.
The Device Security Analysis task rewards explanation and evidence, not just correct identification. Naming the attack type without explaining how the log evidence supports that classification will not earn full credit.
The AP Cybersecurity Exam has one FRQ, and it is always a Device Security Analysis task. Every skill in these three guides, log reading, source cross-referencing, and incident report writing, is directly tested in that single question. There is no other FRQ to prepare for.
Detection skills 3.D, 4.4.D, and 5.6.E are tested in multiple-choice questions that present log excerpts and ask you to classify attacks or identify indicators of compromise. The log analysis guide builds the same reading skill you need for both question types.
The incident report format and source analysis workflow are not limited to the FRQ. Multiple-choice questions across Units 3, 4, and 5 present policy documents, firewall configurations, and permission tables and ask you to evaluate security decisions. The cross-referencing habit these guides build applies throughout the exam.
Open the individual guides for Device Security Analysis when you want a closer review of one topic.
browse guidesThe Device Security Analysis is the single free-response question on the AP Cybersecurity Exam, worth 30% of your score. You get a suggested 50 minutes to analyze simulated sources from one device, including logs, firewall configs, permissions, and policies, then identify security issues, detect attacks, and recommend mitigations.
The Device Security Analysis task typically provides several simulated sources tied to a single device. These can include security policy documents, firewall configuration files, file-system permission settings, authentication logs, network logs, and application logs. Strong responses treat these as a connected set and cross-reference them rather than analyzing each source in isolation.
Focus on the meaningful fields in each log type: timestamps, IP addresses, status codes, usernames, and actions. Look for indicators of compromise like repeated failed logins, unusual access times, or unexpected IP addresses. On the FRQ, always cite specific log lines as evidence rather than making general claims about what the log shows.
The Device Security Analysis FRQ assesses Skill Category 2 (Mitigate Risk) and Skill Category 3 (Detect Attacks). Log reading connects especially to detection skills 3.D and 4.4.D, where you classify attacks using digital evidence, and to 5.6.E, which covers analyzing logs for application-layer attacks.
Quote or paraphrase specific lines from the provided sources and explain what they show. Vague references to a log or policy do not earn full credit. Point to exact fields, values, or rules, then connect them to a security finding or attack classification. Precision in citing evidence is what separates strong responses from weak ones.
Unit 4 covers the concepts behind securing devices, including hardware, software, and configuration principles. The Device Security Analysis page focuses on applying those concepts in the exam's free-response format. It provides guides on reading logs, cross-referencing sources, and writing incident reports, all skills needed to perform well on the actual FRQ.