Review AP Cybersecurity Unit 1 to build your foundation in how adversaries attack systems and how defenders respond. This unit covers social engineering, password attacks, public Wi-Fi threats, and how AI is reshaping both offense and defense.
Use the topic guides, key terms, and practice questions available for every topic in this unit to sharpen your understanding before the exam.
Unit 1 establishes the adversarial mindset that runs through all of AP Cybersecurity. Before students secure spaces, networks, devices, or applications in later units, they need to understand how attacks actually work and why people fall for them.
Social engineering targets people, not machines. Adversaries use intimidation and urgency to pressure targets into revealing credentials, clicking malicious links, or downloading malware, often through email, text, or social media.
Weak passwords built on predictable patterns give adversaries a foothold. Strong, unique passwords combined with multifactor authentication (MFA) close the gap that online password attacks and dictionary attacks exploit.
Generative AI and voice cloning let adversaries craft convincing phishing messages and impersonate real people. Defenders use AI in return to review configurations, scan code, and sort millions of network events to flag malicious activity.
Whether the target is a person responding to a fake urgent email, a user with a guessable password, or a traveler connecting to an evil twin network, adversaries consistently look for the path of least resistance. Unit 1 trains you to recognize that path and understand the defenses that block it.
Covers how adversaries use intimidation, urgency, authority, familiarity, and scarcity to manipulate targets into revealing information, clicking malicious links, or downloading malware. Includes impacts such as impersonation, account takeover, and malware installation.
Covers how adversaries exploit weak passwords and predictable patterns through online password attacks and dictionary attacks. Explains how to recognize attack signs in authentication logs and how strong passwords, passphrases, password managers, and MFA strengthen authentication.
Covers adversary skill levels and motivations, and three wireless attack types: evil twin, jamming, and war driving. Explains protective actions including verifying SSIDs, relying on HTTPS, and using a VPN on untrusted networks.
Covers how adversaries use AI tools including LLMs, voice cloning, and deepfakes to enhance phishing, impersonation, reconnaissance, and malware development. Explains defenses including shared secrets, MFA, keeping sensitive data out of AI tools, and verifying AI output.
Covers how defenders use AI-powered tools to review security configurations, scan application code, suggest detection rules, and analyze large volumes of network events to detect threats. Emphasizes that human experts must review all AI recommendations before implementation.
Social engineering attacks manipulate people rather than exploiting technical vulnerabilities. Adversaries use psychological principles to get targets to reveal sensitive information (elicitation), click malicious links, or download malicious files. Attacks arrive by email, text (smishing), phone (vishing), social media, or in person.
| Tactic | Psychological Principle | Example Delivery |
|---|---|---|
| Intimidation | Fear of negative consequences | Email threatening account suspension |
| Urgency | Pressure to act before thinking | Text claiming a package will be returned in 2 hours |
| Familiarity | Trust in known entities | Message appearing to come from a coworker |
| Authority | Deference to figures of power | Impersonating IT support or a manager |
| Scarcity | Fear of missing out | Offer expiring in minutes to force a quick click |
Online password attacks involve adversaries submitting login guesses to a live account using common passwords, predictable patterns, or stolen credentials. Weak passwords built on personal information make these attacks easier. Strong passwords and MFA are the primary defenses.
| Attack Type | How It Works | Key Defense |
|---|---|---|
| Online password attack | Submits guesses directly to a live login page | Account lockout policies and MFA |
| Dictionary attack | Uses a custom list built from target's personal info | Avoid personal info in passwords |
| Credential stuffing | Replays username/password pairs stolen from other breaches | Unique password per account |
Public Wi-Fi is a convenient attack surface. Adversaries range from low-skilled users running downloaded tools to high-skilled operators who build custom exploits and discover zero-day vulnerabilities. Three wireless attack types appear on the exam: evil twin, jamming, and war driving.
| Attack | Mechanism | Effect on Victim |
|---|---|---|
| Evil twin | Rogue WAP mimics legitimate SSID | Traffic captured by adversary |
| Jamming | EM signal floods wireless frequency | Users lose network access (DoS) |
| War driving | Scanning for network beacons while mobile | Adversary maps vulnerable networks for later targeting |
AI does not create entirely new attack categories. It makes existing attacks, such as phishing, impersonation, and malware development, faster, cheaper, and more convincing. Adversaries use large language models (LLMs) to write polished phishing messages in any language and use voice cloning and deepfake technology to impersonate real people on calls or video.
Defenders use AI-powered tools to handle the scale of modern network activity that humans cannot review manually. AI assists with hardening configurations, finding code vulnerabilities, suggesting detection rules, and sorting millions of daily network events to surface likely malicious activity. Human review of AI recommendations is always required before implementation.
| Defensive Use Case | What AI Does | Who Reviews |
|---|---|---|
| Configuration hardening | Recommends stronger firewall and access control settings | Security technician |
| Code vulnerability scanning | Identifies flaws and suggests mitigations | Programmer |
| Detection rule creation | Suggests rules for automated detection systems | Detection engineer |
| Threat detection | Sorts network events and flags likely malicious activity | Cybersecurity analyst |
Try AP-style multiple-choice questions and written prompts after you review the notes.
| Term | Definition |
|---|---|
| social engineering | Attacks that use psychological manipulation rather than technical exploits to trick targets into revealing information, clicking malicious links, or downloading malicious files. |
| intimidation | A social engineering tactic that threatens a target with negative consequences to pressure them into complying with an adversary's request. |
| urgency | A social engineering tactic that creates artificial time pressure, preventing targets from thinking critically before acting. |
| elicitation | Subtly drawing sensitive information out of a target through seemingly normal conversation or requests. |
| phishing | A social engineering attack delivered by email that tricks recipients into revealing credentials, clicking malicious links, or downloading malware. |
| online password attack | An attack in which an adversary submits login guesses directly to a live account using common passwords, predictable patterns, or stolen credentials. |
| dictionary attack | A password attack that uses a custom list of likely passwords built from personal information about the target, submitted by an automated tool. |
| multifactor authentication | An authentication method requiring two or more proofs of identity, such as a password plus a one-time code, so a stolen password alone cannot grant access. |
| evil twin attack | An attack in which an adversary sets up a rogue wireless access point with an SSID matching a legitimate network to capture victim traffic. |
| jamming attack | An attack that floods a wireless frequency with electromagnetic signals to block legitimate network traffic, creating a denial of service condition. |
| war driving | The practice of scanning for wireless network beacons while moving through an area to map available networks and identify vulnerable targets. |
| VPN | A virtual private network that encrypts all user traffic to the VPN operator's servers, preventing a rogue access point from reading traffic content. |
| deepfake | AI-generated audio or video that realistically impersonates a real person, used by adversaries to commit fraud or extract sensitive information. |
| large language model | A generative AI system that adversaries can use to craft convincing, grammatically correct phishing messages in any language at scale. |
| zero day | An undocumented vulnerability that has not been publicly disclosed or patched, discoverable only by high-skilled adversaries. |
Intimidation threatens negative consequences to force compliance. Urgency creates time pressure to prevent careful thinking. They often appear together in the same attack, but they are distinct psychological mechanisms and the exam may ask you to identify each separately.
HTTPS does protect the content of web traffic even on a rogue network, but an evil twin can still capture unencrypted traffic, DNS queries, and metadata. Verifying the SSID before connecting is still necessary.
A VPN encrypts traffic between the user and the VPN provider, blocking the rogue access point from reading it. However, the VPN provider itself can see the traffic. A VPN shifts trust, it does not eliminate it.
AI-powered tools can suggest stronger configurations, flag code vulnerabilities, and propose detection rules, but every recommendation must be reviewed by a qualified human before implementation. AI assists; it does not replace expert judgment.
Voice cloning can defeat voice-based authentication alone. MFA adds a second factor that a cloned voice cannot satisfy, making it an effective layer of defense even when AI impersonation is convincing.
Expect questions that present a short attack scenario and ask you to identify the attack type, the psychological tactic used, or the adversary skill level. Practice reading scenarios carefully to distinguish, for example, an evil twin from a jamming attack, or intimidation from urgency in a phishing message.
Questions may ask you to explain why a specific defense, such as MFA, a VPN, or a strong passphrase, addresses a particular threat. Be ready to connect the mechanism of the attack to the mechanism of the defense rather than just naming the tool.
Because AI appears on both sides of Unit 1, questions may ask you to compare how AI is used offensively versus defensively, or to explain why human oversight is required even when AI tools are used for defense. Practice articulating the limits of AI recommendations in security contexts.
Open the individual guides for Unit 1 when you want a closer review of one topic.
browse guidesAP Cyber Unit 1 covers 5 topics: 1.1 Understanding Social Engineering, 1.2 Suspicious Website Logins, 1.3 Best Practices for Public Networks, 1.4 AI-Based Cybersecurity Attacks, and 1.5 Leveraging AI in Cyber Defense. Together they build a foundation in how adversaries attack systems and how to defend against them. See the full topic breakdown at /ap-cybersecurity/unit-1.
The AP Cyber Unit 1 progress check includes both MCQ and FRQ parts drawn from all five unit topics: social engineering, suspicious website logins, public network safety, AI-based attacks, and AI in cyber defense. MCQ questions test recognition of attack types and defensive strategies. FRQ questions ask you to explain or analyze a scenario using those same concepts. For matched practice questions that mirror the progress check format, visit /ap-cybersecurity/unit-1.
AP Cyber Unit 1 FRQs most often come from topics like Understanding Social Engineering (1.1), Suspicious Website Logins (1.2), and AI-Based Cybersecurity Attacks (1.4). These questions typically ask you to identify an attack type, explain how it works, or recommend a defensive measure for a given scenario. To practice, write out short scenario-based responses, then check whether you named the specific attack or defense and explained the reasoning clearly. You can find Unit 1 FRQ practice at /ap-cybersecurity/unit-1.
The best place to find AP Cyber Unit 1 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-1. That page has MCQ practice covering all five topics: social engineering, suspicious website logins, public network safety, AI-based attacks, and AI in cyber defense. Working through unit-specific MCQs before a full practice test helps you spot which topics need more review.
Start AP Cyber Unit 1 by learning the attack types first: social engineering (1.1), weak authentication exploits (1.2), and public Wi-Fi threats (1.3). Once those feel solid, move to the AI topics (1.4 and 1.5), which build on the same attacker-vs-defender framework. For each topic, try to explain the attack in plain language, then name one concrete defense. That pattern shows up in both MCQ and FRQ questions. Find study guides and practice for all five topics at /ap-cybersecurity/unit-1.