🔒AP Cybersecurity
1. You are a cybersecurity analyst reviewing evidence from a student's laptop and accounts to investigate potential security incidents. Use the provided sources to analyze the security posture, identify attacks, and recommend defenses. All sources are simulated for this practice question.
Supplied evidence:
</>TEXTSource 1: Student Device Security Policy (Excerpt) Rule 1: Passwords must be at least 8 characters long. Rule 2: Students must connect to the "School_Guest" Wi-Fi network when on campus which school IT operates and monitors for known threats. Rule 3: Multifactor Authentication (MFA) is recommended, but not required, for student email accounts. Source 2: Authentication Logs (Student Email Portal) Timestamp | IP Address | Event | Status 08:01:12 | 198.51.100.50 | Login Attempt | Success 09:15:00 | 203.0.113.45 | Login Attempt | Failed (Invalid Password) 09:15:02 | 203.0.113.45 | Login Attempt | Failed (Invalid Password) 09:15:05 | 203.0.113.45 | Login Attempt | Failed (Invalid Password) 09:15:07 | 203.0.113.45 | Login Attempt | Failed (Invalid Password) 10:30:00 | 192.0.2.15 | Login Attempt | Success Source 3: Suspicious Text Message (Received at 09:10) "URGENT: Your student account will be locked in 15 minutes due to suspicious activity. Click here [http://school-portal-update.example/login] immediately to verify your password and prevent account deletion. - IT Dept" Source 4: Network Context & Authorized Behavior Device Owner: Alex (Student) Authorized Home Network IP: 198.51.100.50 Public Wi-Fi Used Today: "CoffeeShop_Free" (IP: 192.0.2.15) The school’s verified sign-in domain is school.example. The public-facing IP addresses shown identify connection sources; they do not identify individual people.
Explain how the policy provision in Rule 2 protects the student's device.
Describe how Rule 3 could be modified to improve the security of student email accounts.
Describe the evidence of a password attack by citing specific log entries from Source 2.
Identify the source IP address associated with the suspected password-guessing attempts.
Identify one psychological tactic used by the adversary in the suspicious text message (Source 3).
Explain how the tactic identified in Part C(i) influences the victim to perform the desired action.
Describe one possible impact for the victim if they click the link in Source 3 and enter their credentials.
Identify the type of wireless cyberattack where an adversary sets up their own access point with a name similar or identical to a target network like "CoffeeShop_Free".
Explain one risk to unencrypted information sent over an untrusted public Wi-Fi network.
Describe one action that can protect traffic between the student’s device and a trusted VPN service while using public Wi-Fi. Explain the protection, without claiming it makes every website trustworthy.
Explain how adversaries take advantage of weak authentication using automated tools.
Explain how enabling Multifactor Authentication (MFA) protects an account even if an adversary successfully obtains the user's password.
Explain how adversaries can use generative AI tools, like large language models (LLMs), to augment phishing attacks like the one seen in Source 3.
Explain how cyber defenders can leverage AI-powered tools to enable faster and more accurate threat detection of events like those shown in Source 2.
00:00
