--- title: "AP Cybersecurity Guided Practice" description: "Fiveable has 3,605 AP Cybersecurity multiple-choice practice questions across 5 units, plus 73 stimulus-based question sets built around a source. Practice one unit or topic at a time." canonical: "https://fiveable.me/ap-cybersecurity/guided-practice" type: "guided-practice" subject: "AP Cybersecurity" --- # AP Cybersecurity Guided Practice ## Overview Fiveable has 3,605 AP Cybersecurity multiple-choice practice questions across 5 units, plus 73 stimulus-based question sets built around a source. Practice one unit or topic at a time. ## Practice Questions by Unit - Unit 1 – Introduction to Security: 879 multiple-choice questions, 13 stimulus sets - Unit 2 – Securing Spaces: 1,090 multiple-choice questions, 13 stimulus sets - Unit 3 – Securing Networks: 764 multiple-choice questions, 13 stimulus sets - Unit 4 – Securing Devices: 347 multiple-choice questions, 16 stimulus sets - Unit 5 – Securing Applications and Data: 525 multiple-choice questions, 18 stimulus sets ## Sample Question **SIEM Alert Dashboard — Endpoint Threat Detection Log** > ======================================================================= > SIEM ALERT DASHBOARD | Sensor: EDR-AGENT-07 | Host: WS-FINANCE-14 > Date Range: 2024-11-12 08:00 – 2024-11-12 14:30 | Exported by: soc_analyst > ======================================================================= > > ID | Timestamp | Severity | Signature | Source IP | Dest IP | Details > ------+---------------------+----------+------------------------------------+-----------------+----------------+------------------------------------------- > 001 | 2024-11-12 08:14:03 | LOW | SCHEDULED_TASK_CREATED | 192.168.10.45 | — | Task: "UpdateHelper"; runs daily 03:00 > 002 | 2024-11-12 08:47:21 | MEDIUM | OUTBOUND_CONNECT_UNUSUAL_PORT | 192.168.10.45 | 203.0.113.88 | Port 4444/TCP; process: svcupdate.exe > 003 | 2024-11-12 09:02:55 | HIGH | KEYLOGGER_BEHAVIOR_DETECTED | 192.168.10.45 | — | Process svcupdate.exe hooking keyboard API; log file written to C:\Users\jmorrow\AppData\Roaming\kl_out.dat > 004 | 2024-11-12 09:03:01 | HIGH | SENSITIVE_FILE_EXFIL_ATTEMPT | 192.168.10.45 | 203.0.113.88 | kl_out.dat uploaded via HTTP POST; 14 KB > 005 | 2024-11-12 09:45:10 | MEDIUM | REGISTRY_PERSISTENCE_KEY_ADDED | 192.168.10.45 | — | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → svcupdate.exe > 006 | 2024-11-12 10:11:33 | CRITICAL | RANSOMWARE_FILE_ENCRYPTION_STARTED | 192.168.10.45 | — | 47 files renamed with .LOCKED extension in C:\Users\jmorrow\Documents\ > 007 | 2024-11-12 10:11:45 | CRITICAL | RANSOM_NOTE_DROPPED | 192.168.10.45 | — | File: README_DECRYPT.txt; text: "Your files are encrypted. Send 1.5 BTC to wallet 1Fz9...within 72 hours." > 008 | 2024-11-12 10:12:00 | HIGH | SHADOW_COPY_DELETION_ATTEMPT | 192.168.10.45 | — | cmd.exe executed: vssadmin delete shadows /all /quiet > 009 | 2024-11-12 11:30:47 | MEDIUM | LATERAL_MOVEMENT_SMB_SCAN | 192.168.10.45 | 192.168.10.0/24| SMB probe to 254 hosts; process: svcupdate.exe > 010 | 2024-11-12 14:22:09 | LOW | ANTIVIRUS_DISABLED | 192.168.10.45 | — | Real-time protection turned off via PowerShell; user context: jmorrow > > ----------------------------------------------------------------------- > SUMMARY: 10 alerts | 2 CRITICAL | 4 HIGH | 3 MEDIUM | 1 LOW > Recommended Action: ISOLATE WS-FINANCE-14 immediately; preserve memory image > ======================================================================= Based on the chronological progression of alerts 003 through 008, which of the following best classifies the adversary's overarching attack methodology? - (A) A double-extortion ransomware campaign combining data theft with system encryption. - (B) A destructive wiper attack designed to permanently erase shadow copies and system files. - (C) A botnet infection utilizing the host primarily for distributed denial-of-service attacks. - (D) An insider threat operation leveraging authorized access to modify registry persistence keys. **Answer: (A)** The sequence of alerts demonstrates a multi-stage attack where the adversary first steals sensitive data (Alerts 003 and 004) and then encrypts the local files while demanding payment (Alerts 006 and 007). Classifying this requires synthesizing the exfiltration and encryption phases, which together define a double-extortion ransomware methodology. ## Related Practice - [AP Cybersecurity unit tests: a timed practice test for every unit](/ap-cybersecurity/unit-test) - [AP Cybersecurity full-length practice exams](/ap-cybersecurity/practice-exams) - [AP Cybersecurity subject hub](/ap-cybersecurity) ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)