Review AP Cybersecurity Unit 1 to build your foundation in how adversaries attack systems and how defenders respond. This unit covers social engineering, password attacks, public Wi-Fi threats, and how AI is reshaping both offense and defense.
Use the topic guides, key terms, and practice questions available for every topic in this unit to sharpen your understanding before the exam.
Unit 1 establishes the adversarial mindset that runs through all of AP Cybersecurity. Before students secure spaces, networks, devices, or applications in later units, they need to understand how attacks actually work and why people fall for them.
Unit 1 covers how adversaries use psychological manipulation, weak authentication, wireless vulnerabilities, and AI-powered tools to compromise systems, and how defenders can counter each threat.
Social engineering targets people, not machines. Adversaries use intimidation and urgency to pressure targets into revealing credentials, clicking malicious links, or downloading malware, often through email, text, or social media.
Weak passwords built on predictable patterns give adversaries a foothold. Strong, unique passwords combined with multifactor authentication (MFA) close the gap that online password attacks and dictionary attacks exploit.
Generative AI and voice cloning let adversaries craft convincing phishing messages and impersonate real people. Defenders use AI in return to review configurations, scan code, and sort millions of network events to flag malicious activity.
Whether the target is a person responding to a fake urgent email, a user with a guessable password, or a traveler connecting to an evil twin network, adversaries consistently look for the path of least resistance. Unit 1 trains you to recognize that path and understand the defenses that block it.
Covers how adversaries use intimidation, urgency, authority, familiarity, and scarcity to manipulate targets into revealing information, clicking malicious links, or downloading malware. Includes impacts such as impersonation, account takeover, and malware installation.
Covers how adversaries exploit weak passwords and predictable patterns through online password attacks and dictionary attacks. Explains how to recognize attack signs in authentication logs and how strong passwords, passphrases, password managers, and MFA strengthen authentication.
Covers adversary skill levels and motivations, and three wireless attack types: evil twin, jamming, and war driving. Explains protective actions including verifying SSIDs, relying on HTTPS, and using a VPN on untrusted networks.
Covers how adversaries use AI tools including LLMs, voice cloning, and deepfakes to enhance phishing, impersonation, reconnaissance, and malware development. Explains defenses including shared secrets, MFA, keeping sensitive data out of AI tools, and verifying AI output.
Covers how defenders use AI-powered tools to review security configurations, scan application code, suggest detection rules, and analyze large volumes of network events to detect threats. Emphasizes that human experts must review all AI recommendations before implementation.
Social engineering attacks manipulate people rather than exploiting technical vulnerabilities. Adversaries use psychological principles to get targets to reveal sensitive information (elicitation), click malicious links, or download malicious files. Attacks arrive by email, text (smishing), phone (vishing), social media, or in person.
Can you explain why urgency is effective as a psychological tactic and give one example of how an adversary would use it in a phishing email?
| Tactic | Psychological Principle | Example Delivery |
|---|---|---|
| Intimidation | Fear of negative consequences | Email threatening account suspension |
| Urgency | Pressure to act before thinking | Text claiming a package will be returned in 2 hours |
| Familiarity | Trust in known entities | Message appearing to come from a coworker |
| Authority | Deference to figures of power | Impersonating IT support or a manager |
| Scarcity | Fear of missing out | Offer expiring in minutes to force a quick click |
Online password attacks involve adversaries submitting login guesses to a live account using common passwords, predictable patterns, or stolen credentials. Weak passwords built on personal information make these attacks easier. Strong passwords and MFA are the primary defenses.
What three signs in an authentication log suggest an online password attack is underway, and what two defenses most directly reduce the risk?
| Attack Type | How It Works | Key Defense |
|---|---|---|
| Online password attack | Submits guesses directly to a live login page | Account lockout policies and MFA |
| Dictionary attack | Uses a custom list built from target's personal info | Avoid personal info in passwords |
| Credential stuffing | Replays username/password pairs stolen from other breaches | Unique password per account |
Public Wi-Fi is a convenient attack surface. Adversaries range from low-skilled users running downloaded tools to high-skilled operators who build custom exploits and discover zero-day vulnerabilities. Three wireless attack types appear on the exam: evil twin, jamming, and war driving.
Describe how an evil twin attack works and identify two actions a user can take to reduce their risk on public Wi-Fi.
| Attack | Mechanism | Effect on Victim |
|---|---|---|
| Evil twin | Rogue WAP mimics legitimate SSID | Traffic captured by adversary |
| Jamming | EM signal floods wireless frequency | Users lose network access (DoS) |
| War driving | Scanning for network beacons while mobile | Adversary maps vulnerable networks for later targeting |
AI does not create entirely new attack categories. It makes existing attacks, such as phishing, impersonation, and malware development, faster, cheaper, and more convincing. Adversaries use large language models (LLMs) to write polished phishing messages in any language and use voice cloning and deepfake technology to impersonate real people on calls or video.
Explain why LLM-generated phishing messages are harder to detect than traditional phishing, and name two defenses against AI-augmented impersonation attacks.
Defenders use AI-powered tools to handle the scale of modern network activity that humans cannot review manually. AI assists with hardening configurations, finding code vulnerabilities, suggesting detection rules, and sorting millions of daily network events to surface likely malicious activity. Human review of AI recommendations is always required before implementation.
Name three specific tasks where AI-powered tools assist cyber defenders, and explain why human review is required in each case.
| Defensive Use Case | What AI Does | Who Reviews |
|---|---|---|
| Configuration hardening | Recommends stronger firewall and access control settings | Security technician |
| Code vulnerability scanning | Identifies flaws and suggests mitigations | Programmer |
| Detection rule creation | Suggests rules for automated detection systems | Detection engineer |
| Threat detection | Sorts network events and flags likely malicious activity | Cybersecurity analyst |
Try AP-style multiple-choice questions and written prompts after you review the notes.
A timed, AP-style test built only from unit 1 questions — multiple choice plus free response, scored with AI feedback. Use the standard format or build your own.
| Term | Definition |
|---|---|
| social engineering | Attacks that use psychological manipulation rather than technical exploits to trick targets into revealing information, clicking malicious links, or downloading malicious files. |
| intimidation | A social engineering tactic that threatens a target with negative consequences to pressure them into complying with an adversary's request. |
| urgency | A social engineering tactic that creates artificial time pressure, preventing targets from thinking critically before acting. |
| elicitation | Subtly drawing sensitive information out of a target through seemingly normal conversation or requests. |
| phishing | A social engineering attack delivered by email that tricks recipients into revealing credentials, clicking malicious links, or downloading malware. |
| online password attack | An attack in which an adversary submits login guesses directly to a live account using common passwords, predictable patterns, or stolen credentials. |
| dictionary attack | A password attack that uses a custom list of likely passwords built from personal information about the target, submitted by an automated tool. |
| multifactor authentication | An authentication method requiring two or more proofs of identity, such as a password plus a one-time code, so a stolen password alone cannot grant access. |
| evil twin attack | An attack in which an adversary sets up a rogue wireless access point with an SSID matching a legitimate network to capture victim traffic. |
| jamming attack | An attack that floods a wireless frequency with electromagnetic signals to block legitimate network traffic, creating a denial of service condition. |
| war driving | The practice of scanning for wireless network beacons while moving through an area to map available networks and identify vulnerable targets. |
| VPN | A virtual private network that encrypts all user traffic to the VPN operator's servers, preventing a rogue access point from reading traffic content. |
| deepfake | AI-generated audio or video that realistically impersonates a real person, used by adversaries to commit fraud or extract sensitive information. |
| large language model | A generative AI system that adversaries can use to craft convincing, grammatically correct phishing messages in any language at scale. |
| zero day | An undocumented vulnerability that has not been publicly disclosed or patched, discoverable only by high-skilled adversaries. |
Intimidation threatens negative consequences to force compliance. Urgency creates time pressure to prevent careful thinking. They often appear together in the same attack, but they are distinct psychological mechanisms and the exam may ask you to identify each separately.
HTTPS does protect the content of web traffic even on a rogue network, but an evil twin can still capture unencrypted traffic, DNS queries, and metadata. Verifying the SSID before connecting is still necessary.
A VPN encrypts traffic between the user and the VPN provider, blocking the rogue access point from reading it. However, the VPN provider itself can see the traffic. A VPN shifts trust, it does not eliminate it.
AI-powered tools can suggest stronger configurations, flag code vulnerabilities, and propose detection rules, but every recommendation must be reviewed by a qualified human before implementation. AI assists; it does not replace expert judgment.
Voice cloning can defeat voice-based authentication alone. MFA adds a second factor that a cloned voice cannot satisfy, making it an effective layer of defense even when AI impersonation is convincing.
Expect questions that present a short attack scenario and ask you to identify the attack type, the psychological tactic used, or the adversary skill level. Practice reading scenarios carefully to distinguish, for example, an evil twin from a jamming attack, or intimidation from urgency in a phishing message.
Questions may ask you to explain why a specific defense, such as MFA, a VPN, or a strong passphrase, addresses a particular threat. Be ready to connect the mechanism of the attack to the mechanism of the defense rather than just naming the tool.
Because AI appears on both sides of Unit 1, questions may ask you to compare how AI is used offensively versus defensively, or to explain why human oversight is required even when AI tools are used for defense. Practice articulating the limits of AI recommendations in security contexts.
Be able to name and explain intimidation, urgency, authority, familiarity, and scarcity, and describe how each manipulates a target's behavior.
Know the three main outcomes: giving up personal information that enables impersonation, surrendering an OTP that enables account takeover, and downloading malware that compromises the device.
List the three signs of an online password attack visible in authentication logs, and explain how long unique passwords, password managers, passphrases, and MFA each reduce risk.
Explain how evil twin, jamming, and war driving attacks work, including the role of SSIDs, WAPs, and electromagnetic signals, and identify the correct defense for each.
Distinguish low-skilled adversaries who use existing tools from high-skilled adversaries who create new tools and discover zero-day vulnerabilities. Know the range of motivations including greed, ideology, and revenge.
Describe how LLMs improve phishing quality, how voice cloning and deepfakes enable impersonation, and how prompt injection and training data poisoning target AI systems themselves.
Name the four defensive use cases for AI tools (configuration review, code scanning, detection rules, threat detection) and state why a qualified human must review AI output before it is implemented.
Read the Topic 1.1 guide and review the key terms for intimidation, urgency, elicitation, phishing, smishing, and vishing. Practice explaining how each tactic works and what happens to a victim who falls for it, focusing on the three impact categories: personal info, OTP theft, and malware.
Read the Topic 1.2 guide and review the key terms for online password attack, dictionary attack, credential stuffing, MFA, OTP, passphrase, and password manager. Use the comparison table in the review notes to distinguish attack types and their specific defenses.
Read the Topic 1.3 guide and review the key terms for evil twin attack, jamming attack, war driving, SSID, WAP, VPN, and zero day. Practice classifying adversaries by skill level and matching each wireless attack to its mechanism and the correct defensive action.
Read the Topic 1.4 guide and review the key terms for deepfake, voice cloning, LLM, generative AI attack, prompt injection, and training data poisoning. For each AI attack type, write out the specific defense that counters it, including shared secrets and MFA for impersonation.
Read the Topic 1.5 guide and review the key terms for AI-powered cyber defense, automated detection system, and threat detection. Use the comparison table to connect each defensive use case to the correct human reviewer, then work through available practice questions to check your understanding across all five topics.
Open the individual guides for Unit 1 when you want a closer review of one topic.
Use AP-style practice after you review the notes so you can check what you understand.
Practice free-response reasoning and compare your answer with scoring guidance.
Estimate your broader AP score goal after you review the course and exam format.
Print the unit cheatsheets ($3) or unit exams ($5) for Unit 1. Yours to keep, no subscription needed.
get printablesAP Cyber Unit 1 covers 5 topics: 1.1 Understanding Social Engineering, 1.2 Suspicious Website Logins, 1.3 Best Practices for Public Networks, 1.4 AI-Based Cybersecurity Attacks, and 1.5 Leveraging AI in Cyber Defense. Together they build a foundation in how adversaries attack systems and how to defend against them. See the full topic breakdown at /ap-cybersecurity/unit-1.
The AP Cyber Unit 1 progress check includes both MCQ and FRQ parts drawn from all five unit topics: social engineering, suspicious website logins, public network safety, AI-based attacks, and AI in cyber defense. MCQ questions test recognition of attack types and defensive strategies. FRQ questions ask you to explain or analyze a scenario using those same concepts. For matched practice questions that mirror the progress check format, visit /ap-cybersecurity/unit-1.
AP Cyber Unit 1 FRQs most often come from topics like Understanding Social Engineering (1.1), Suspicious Website Logins (1.2), and AI-Based Cybersecurity Attacks (1.4). These questions typically ask you to identify an attack type, explain how it works, or recommend a defensive measure for a given scenario. To practice, write out short scenario-based responses, then check whether you named the specific attack or defense and explained the reasoning clearly. You can find Unit 1 FRQ practice at /ap-cybersecurity/unit-1.
The best place to find AP Cyber Unit 1 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-1. That page has MCQ practice covering all five topics: social engineering, suspicious website logins, public network safety, AI-based attacks, and AI in cyber defense. Working through unit-specific MCQs before a full practice test helps you spot which topics need more review.
Start AP Cyber Unit 1 by learning the attack types first: social engineering (1.1), weak authentication exploits (1.2), and public Wi-Fi threats (1.3). Once those feel solid, move to the AI topics (1.4 and 1.5), which build on the same attacker-vs-defender framework. For each topic, try to explain the attack in plain language, then name one concrete defense. That pattern shows up in both MCQ and FRQ questions. Find study guides and practice for all five topics at /ap-cybersecurity/unit-1.