AP Cybersecurity MCQs
Recommended study guides
Answer 5 questions to see which guides will help you the most
Practice Settings
AP Cybersecurity practice questions by unit
Fiveable has 3,605 AP Cybersecurity multiple-choice practice questions across 5 units, plus 73 stimulus-based question sets built around a source. Practice one unit or topic at a time.
- Unit 1 – Introduction to Security: 879 multiple-choice questions, 13 stimulus sets
- Unit 2 – Securing Spaces: 1,090 multiple-choice questions, 13 stimulus sets
- Unit 3 – Securing Networks: 764 multiple-choice questions, 13 stimulus sets
- Unit 4 – Securing Devices: 347 multiple-choice questions, 16 stimulus sets
- Unit 5 – Securing Applications and Data: 525 multiple-choice questions, 18 stimulus sets
Sample AP Cybersecurity practice question
ID | Timestamp | Severity | Signature | Source IP | Dest IP | Details
------+---------------------+----------+------------------------------------+-----------------+----------------+-------------------------------------------
001 | 2024-11-12 08:14:03 | LOW | SCHEDULED_TASK_CREATED | 192.168.10.45 | — | Task: "UpdateHelper"; runs daily 03:00
002 | 2024-11-12 08:47:21 | MEDIUM | OUTBOUND_CONNECT_UNUSUAL_PORT | 192.168.10.45 | 203.0.113.88 | Port 4444/TCP; process: svcupdate.exe
003 | 2024-11-12 09:02:55 | HIGH | KEYLOGGER_BEHAVIOR_DETECTED | 192.168.10.45 | — | Process svcupdate.exe hooking keyboard API; log file written to C:\Users\jmorrow\AppData\Roaming\kl_out.dat
004 | 2024-11-12 09:03:01 | HIGH | SENSITIVE_FILE_EXFIL_ATTEMPT | 192.168.10.45 | 203.0.113.88 | kl_out.dat uploaded via HTTP POST; 14 KB
005 | 2024-11-12 09:45:10 | MEDIUM | REGISTRY_PERSISTENCE_KEY_ADDED | 192.168.10.45 | — | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → svcupdate.exe
006 | 2024-11-12 10:11:33 | CRITICAL | RANSOMWARE_FILE_ENCRYPTION_STARTED | 192.168.10.45 | — | 47 files renamed with .LOCKED extension in C:\Users\jmorrow\Documents
007 | 2024-11-12 10:11:45 | CRITICAL | RANSOM_NOTE_DROPPED | 192.168.10.45 | — | File: README_DECRYPT.txt; text: "Your files are encrypted. Send 1.5 BTC to wallet 1Fz9...within 72 hours."
008 | 2024-11-12 10:12:00 | HIGH | SHADOW_COPY_DELETION_ATTEMPT | 192.168.10.45 | — | cmd.exe executed: vssadmin delete shadows /all /quiet
009 | 2024-11-12 11:30:47 | MEDIUM | LATERAL_MOVEMENT_SMB_SCAN | 192.168.10.45 | 192.168.10.0/24| SMB probe to 254 hosts; process: svcupdate.exe
010 | 2024-11-12 14:22:09 | LOW | ANTIVIRUS_DISABLED | 192.168.10.45 | — | Real-time protection turned off via PowerShell; user context: jmorrow
SUMMARY: 10 alerts | 2 CRITICAL | 4 HIGH | 3 MEDIUM | 1 LOW Recommended Action: ISOLATE WS-FINANCE-14 immediately; preserve memory image
Based on the chronological progression of alerts 003 through 008, which of the following best classifies the adversary's overarching attack methodology?
A double-extortion ransomware campaign combining data theft with system encryption.
A destructive wiper attack designed to permanently erase shadow copies and system files.
A botnet infection utilizing the host primarily for distributed denial-of-service attacks.
An insider threat operation leveraging authorized access to modify registry persistence keys.
Explanation
The sequence of alerts demonstrates a multi-stage attack where the adversary first steals sensitive data (Alerts 003 and 004) and then encrypts the local files while demanding payment (Alerts 006 and 007). Classifying this requires synthesizing the exfiltration and encryption phases, which together define a double-extortion ransomware methodology.