Skip to main content
We’re so back. See what’s new for the 2026-2027 school year →

AP Cybersecurity MCQs

Pep mascot

Content Filters

Question Types

Export assessment:print

Not sure where to begin?

  • Recommended study guides

  • Answer 5 questions to see which guides will help you the most

  • Keyboard Controls

  • A, B, C, D: Select the corresponding answer

  • K: Clear grid temporarily

Practice Settings

AP Cybersecurity practice questions by unit

Fiveable has 3,605 AP Cybersecurity multiple-choice practice questions across 5 units, plus 73 stimulus-based question sets built around a source. Practice one unit or topic at a time.

  • Unit 1 – Introduction to Security: 879 multiple-choice questions, 13 stimulus sets
  • Unit 2 – Securing Spaces: 1,090 multiple-choice questions, 13 stimulus sets
  • Unit 3 – Securing Networks: 764 multiple-choice questions, 13 stimulus sets
  • Unit 4 – Securing Devices: 347 multiple-choice questions, 16 stimulus sets
  • Unit 5 – Securing Applications and Data: 525 multiple-choice questions, 18 stimulus sets

Sample AP Cybersecurity practice question

ID | Timestamp | Severity | Signature | Source IP | Dest IP | Details ------+---------------------+----------+------------------------------------+-----------------+----------------+------------------------------------------- 001 | 2024-11-12 08:14:03 | LOW | SCHEDULED_TASK_CREATED | 192.168.10.45 | — | Task: "UpdateHelper"; runs daily 03:00 002 | 2024-11-12 08:47:21 | MEDIUM | OUTBOUND_CONNECT_UNUSUAL_PORT | 192.168.10.45 | 203.0.113.88 | Port 4444/TCP; process: svcupdate.exe 003 | 2024-11-12 09:02:55 | HIGH | KEYLOGGER_BEHAVIOR_DETECTED | 192.168.10.45 | — | Process svcupdate.exe hooking keyboard API; log file written to C:\Users\jmorrow\AppData\Roaming\kl_out.dat 004 | 2024-11-12 09:03:01 | HIGH | SENSITIVE_FILE_EXFIL_ATTEMPT | 192.168.10.45 | 203.0.113.88 | kl_out.dat uploaded via HTTP POST; 14 KB 005 | 2024-11-12 09:45:10 | MEDIUM | REGISTRY_PERSISTENCE_KEY_ADDED | 192.168.10.45 | — | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → svcupdate.exe 006 | 2024-11-12 10:11:33 | CRITICAL | RANSOMWARE_FILE_ENCRYPTION_STARTED | 192.168.10.45 | — | 47 files renamed with .LOCKED extension in C:\Users\jmorrow\Documents
007 | 2024-11-12 10:11:45 | CRITICAL | RANSOM_NOTE_DROPPED | 192.168.10.45 | — | File: README_DECRYPT.txt; text: "Your files are encrypted. Send 1.5 BTC to wallet 1Fz9...within 72 hours." 008 | 2024-11-12 10:12:00 | HIGH | SHADOW_COPY_DELETION_ATTEMPT | 192.168.10.45 | — | cmd.exe executed: vssadmin delete shadows /all /quiet 009 | 2024-11-12 11:30:47 | MEDIUM | LATERAL_MOVEMENT_SMB_SCAN | 192.168.10.45 | 192.168.10.0/24| SMB probe to 254 hosts; process: svcupdate.exe 010 | 2024-11-12 14:22:09 | LOW | ANTIVIRUS_DISABLED | 192.168.10.45 | — | Real-time protection turned off via PowerShell; user context: jmorrow

SUMMARY: 10 alerts | 2 CRITICAL | 4 HIGH | 3 MEDIUM | 1 LOW Recommended Action: ISOLATE WS-FINANCE-14 immediately; preserve memory image

Based on the chronological progression of alerts 003 through 008, which of the following best classifies the adversary's overarching attack methodology?

A double-extortion ransomware campaign combining data theft with system encryption.

Correct answer

A destructive wiper attack designed to permanently erase shadow copies and system files.

A botnet infection utilizing the host primarily for distributed denial-of-service attacks.

An insider threat operation leveraging authorized access to modify registry persistence keys.

Explanation

The sequence of alerts demonstrates a multi-stage attack where the adversary first steals sensitive data (Alerts 003 and 004) and then encrypts the local files while demanding payment (Alerts 006 and 007). Classifying this requires synthesizing the exfiltration and encryption phases, which together define a double-extortion ransomware methodology.

More AP Cybersecurity practice