Review AP Cybersecurity Unit 2 to understand how adversaries breach physical spaces and how defenders use managerial, physical, and detection controls to stop them. This unit builds the adversarial thinking skills you will apply across every later unit in the course.
Use the topic guides, key terms, and practice questions available for this unit to work through each concept before your exam.
What is AP Cybersecurity Unit 2? Unit 2 asks you to think like both an attacker and a defender in a physical space. Adversaries who reach a device in person can often bypass firewalls, encryption, and other technical controls entirely, so physical security is not optional. This unit gives you the vocabulary and reasoning framework to identify weaknesses, evaluate threats, and choose controls that prevent, detect, or correct physical breaches.
Social engineers exploit psychology rather than technology. Tactics include pretexting, authority, urgency, scarcity, and familiarity. Adversary types range from low-skilled script kiddies to insider threats and cyberterrorists, each with different motivations and capabilities.
Physical attacks include piggybacking, tailgating, shoulder surfing, dumpster diving, and card cloning. Risk is assessed by weighing the likelihood of an exploit against the severity of damage. Organizations then choose to avoid, transfer, mitigate, or accept each risk.
Protecting a space uses managerial controls like security awareness training and workstation policies, and physical controls like fencing, locks, card readers, and access control vestibules. Detection relies on cameras, motion sensors, security guards, and employees, each placed where they provide the most coverage.
A single control is never enough. Defense in depth layers human, physical, network, device, application, and data protections so that when one control fails, another limits the damage. In Unit 2, that principle plays out in the physical space: a fence deters entry, a card reader logs and restricts it, a camera records it, and a motion sensor triggers an alert. Each layer compensates for the weaknesses of the others.
Covers social engineering tactics (pretexting, authority, urgency, scarcity, familiarity, consensus, intimidation), adversary types (script kiddies, hacktivists, insider threats, cyberterrorists), the six phases of a cyberattack, risk assessment using likelihood and severity, the four risk management strategies, security control types, and defense in depth.
Covers common physical attacks including piggybacking, tailgating, shoulder surfing, dumpster diving, and card cloning; how threats exploit physical vulnerabilities such as power disruption and unauthorized access; and how to assess and document risk levels from physical weaknesses in a space.
Covers managerial controls like security awareness training, workstation security policies, and clean desk policies, as well as physical controls including fencing, bollards, locks, card readers, access control vestibules, turnstiles, disabled USB ports, and uninterruptible power supplies.
Covers detection controls including cameras, security guards, motion sensors, and alert employees; how to determine effective placement for each control based on traffic patterns and coverage needs; and how to apply detection techniques such as pairing motion sensors with cameras and reviewing door-open logs to identify tailgating.
Social engineering manipulates people psychologically rather than exploiting technical flaws. Adversaries use tactics like pretexting to create a believable cover story, authority to impersonate someone with power, urgency to force quick decisions, and scarcity to suggest limited time or resources. Familiarity and consensus round out the toolkit by building false trust or social pressure. Adversary types matter because they shape the likely threat: script kiddies use existing tools with little skill, hacktivists are driven by causes, insider threats already have legitimate access, and cyberterrorists target critical infrastructure. Cyberattacks move through phases: reconnaissance using open source intelligence (OSINT), initial access often via social engineering, persistence through command and control (C2), lateral movement to reach more systems, taking action on objectives, and evading detection.
| Adversary Type | Primary Motivation | Skill Level | Example Target |
|---|---|---|---|
| Script kiddie | Greed or recognition | Low | Any accessible system |
| Hacktivist | Social or political cause | Varies | Organizations they oppose |
| Insider threat | Greed or revenge | High (has access) | Employer's data or systems |
| Cyberterrorist | Politics or ideology | High | Power grids, water plants |
Risk exists when a threat can exploit a vulnerability to harm an asset. Assets include data, physical property, intellectual property, reputation, and digital infrastructure. Risk assessment weighs two factors: the likelihood that a vulnerability will be exploited and the severity of the resulting damage. Likelihood depends on target value, exploit difficulty, and adversary motivation. Once assessed, organizations choose one of four responses: avoid the risky activity, transfer the risk to an insurer or third party, mitigate it with security controls, or accept the residual risk that remains after other strategies are applied. Security controls are classified by what they protect (CIA triad: confidentiality, integrity, availability) and by type: physical controls like locks and cameras, technical controls like firewalls and encryption, and managerial controls like policies and training. Defense in depth layers all three types so no single failure exposes the whole system.
| Risk Response | What It Does | When It Applies |
|---|---|---|
| Avoid | Stops the risky activity entirely | Activity is not essential to the mission |
| Transfer | Shifts financial burden to insurer or third party | Risk cannot be eliminated but cost can be shared |
| Mitigate | Adds controls to reduce likelihood or impact | Activity must continue; controls are feasible |
| Accept | Acknowledges residual risk without further action | Remaining risk is within tolerable limits |
Physical attacks let adversaries reach devices directly, often bypassing technical controls entirely. Piggybacking uses social engineering to get an authorized person to grant access, such as holding a door open for someone carrying boxes. Tailgating is similar but the authorized person is unaware they are being followed. Shoulder surfing means watching a user enter credentials or view sensitive data. Dumpster diving recovers discarded documents or hardware that contain useful information. Card cloning copies the data from an access card to create a duplicate. Physical vulnerabilities arise when sensitive systems are in spaces with insufficient access controls. High-risk scenarios include an unlocked server room in an unmonitored hallway. Moderate-risk scenarios include a reception computer with exposed USB ports connected to the internal network. Natural disasters also count as threats because they can destroy hardware and disrupt services.
| Attack | Requires Social Engineering? | Authorized Person Aware? |
|---|---|---|
| Piggybacking | Yes | Yes |
| Tailgating | No | No |
| Shoulder surfing | No | Usually not |
| Dumpster diving | No | N/A |
| Card cloning | Sometimes | No |
Protecting a physical space requires both managerial and physical controls working together. Managerial controls include security awareness training (teaching employees to spot social engineering, not badge others in, and prevent device theft), workstation security policies (locking screens when stepping away, clean desk policies, privacy screen filters), acceptable use policies, and software installation policies. Physical controls create barriers and checkpoints: fencing and bollards deter vehicle and foot access at the perimeter, locks on doors and server cabinets prevent unauthorized entry, card readers log and restrict badge access, access control vestibules and turnstiles stop piggybacking by allowing only one person through at a time, and disabling USB ports prevents unauthorized data transfer. Uninterruptible power supplies (UPS) protect against power disruption attacks by keeping systems running during outages.
Detection controls identify a breach after or as it happens. Cameras provide a visual record and can be paired with facial recognition to alert defenders when an unauthorized person enters. Security guards can observe and respond in real time. Motion sensors alert security to unexpected movement but generate false alarms in high-traffic areas, so they work best in low-traffic spaces like server rooms. Employees are often the first to notice an unfamiliar person and should know how to report it. Placement matters as much as the control itself. Cameras should cover all ingress and egress points, be angled to capture useful detail, and be positioned where they cannot easily be tampered with. Motion sensors belong in areas where movement is unexpected. Locks should secure every entry to a sensitive area, and for the most sensitive spaces, an access control vestibule adds a second barrier. Door sensors that log how long an entry stays open can flag potential tailgating when a door is open longer than a single badge swipe normally requires.
| Detection Control | Best Placement | Works Best When Paired With |
|---|---|---|
| Camera | Ingress/egress points, server rooms | Facial recognition software, security guard monitoring |
| Motion sensor | Low-traffic areas, server rooms | Camera to visually verify the alert |
| Security guard | Entry points, reception areas | Camera feeds and badge access logs |
| Door sensor | All restricted-area entries | Badge access logs to detect tailgating |
Try AP-style multiple-choice questions and written prompts after you review the notes.
| Term | Definition |
|---|---|
| CIA triad | The three core security principles: confidentiality (restrict access to authorized users), integrity (keep data accurate and unaltered), and availability (keep systems accessible when needed). |
| defense in depth | A layered security strategy that uses multiple control types so that when one layer is bypassed, others still limit damage. |
| pretexting | A social engineering tactic where an adversary creates a believable false reason to contact a target, such as posing as IT support. |
| risk | The potential for harm that exists when a threat can exploit a vulnerability to compromise an asset. |
| residual risk | The risk that remains after an organization has applied avoidance, transference, and mitigation strategies; the level the organization accepts. |
| piggybacking | A physical attack where an adversary uses social engineering to get an authorized person to knowingly grant them access to a restricted area. |
| tailgating | A physical attack where an adversary follows an authorized person into a restricted area without that person's awareness. |
| shoulder surfing | Watching a user enter credentials or view sensitive data to capture that information. |
| dumpster diving | Searching discarded materials for documents, hardware, or data useful to an attacker. |
| access control vestibule | An entry chamber that allows only one person through at a time, preventing piggybacking and tailgating. |
| managerial control | A policy, procedure, or training program that shapes human behavior to support security, such as a workstation security policy or acceptable use policy. |
| physical control | A tangible security measure in the physical space, such as a lock, fence, bollard, or camera. |
| surveillance camera | A camera that records and monitors a space; most effective when footage is actively monitored and stored for post-incident review. |
| motion sensor | A device that detects movement and triggers an alert; most effective in low-traffic areas where any movement is unexpected. |
| open source intelligence | Freely available information gathered during the reconnaissance phase of an attack to learn about a target. |
Piggybacking requires social engineering: the authorized person knowingly (if mistakenly) lets the adversary in. Tailgating means the authorized person has no idea they are being followed. The distinction matters when identifying which attack occurred in a scenario.
Risk acceptance is a deliberate decision made after avoidance, transference, and mitigation have been considered. It acknowledges that absolute security is unattainable and that the residual risk falls within tolerable limits. It is not the same as ignoring a risk.
Motion sensors in busy hallways generate constant false alarms, which causes staff to stop responding seriously to alerts. Motion sensors are most effective in low-traffic spaces like server rooms where any movement is unexpected.
Physical access to a device often lets an adversary bypass firewalls, encryption, and other technical controls entirely. Defense in depth requires physical controls as a foundational layer, not an optional add-on.
A workstation security policy is a managerial control. A lock is a physical control. A firewall is a technical control. Exam scenarios often ask you to identify the type of control being described or to recommend the correct type for a given situation.
AP Cybersecurity exam questions frequently describe a physical space or incident and ask you to identify the attack that occurred, classify the vulnerability, or recommend a specific control. Practice reading a scenario and quickly naming the attack type (piggybacking vs. tailgating), the control type (managerial vs. physical vs. technical), and the CIA principle at risk.
Expect questions that ask you to evaluate a described risk using likelihood and severity, then justify a risk response. You may need to explain why mitigation is preferred over acceptance in one scenario, or why avoidance is not possible when an activity is central to an organization's mission.
Questions may present a building diagram or description and ask where to place cameras, motion sensors, or locks, and why. Strong answers explain the reasoning behind placement choices, such as why a motion sensor in a server room is more effective than one in a lobby, and how layering controls creates resilience when one is bypassed.
Open the individual guides for Unit 2 when you want a closer review of one topic.
browse guidesAP Cyber Unit 2: Securing Spaces covers 4 topics: 2.1 Cyber Foundations, 2.2 Physical Vulnerabilities and Attacks, 2.3 Protecting Physical Spaces, and 2.4 Detecting Physical Attacks. The unit builds adversarial thinking by focusing on how physical access to a device can bypass technical controls, and how to select and place security devices to stop it. See everything organized at /ap-cybersecurity/unit-2.
The AP Cyber Unit 2 progress check pulls questions from all four unit topics: Cyber Foundations, Physical Vulnerabilities and Attacks, Protecting Physical Spaces, and Detecting Physical Attacks. The MCQ portion tests recognition of attack types and mitigation strategies. The FRQ portion asks you to analyze a physical scenario, identify vulnerabilities, and justify security device placement. For matched practice questions that mirror the progress check format, visit /ap-cybersecurity/unit-2.
AP Cyber Unit 2 FRQs typically draw from Physical Vulnerabilities and Attacks (2.2), Protecting Physical Spaces (2.3), and Detecting Physical Attacks (2.4). These questions give you a physical location scenario and ask you to identify threats, select appropriate security devices, and explain placement decisions. Practice by writing out your reasoning step by step, then checking whether you named a specific vulnerability, a specific mitigation, and a justification. Find practice prompts and worked examples at /ap-cybersecurity/unit-2.
The best place to find AP Cyber Unit 2 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-2. That page has MCQs covering all 4 topics: Cyber Foundations, Physical Vulnerabilities and Attacks, Protecting Physical Spaces, and Detecting Physical Attacks. Working through unit-specific MCQs before a full practice test helps you lock in the physical security concepts before mixing them with other units.
Start with topic 2.1 Cyber Foundations to get the vocabulary straight, then move through 2.2 Physical Vulnerabilities and Attacks so you can name specific attack types. From there, study 2.3 Protecting Physical Spaces and 2.4 Detecting Physical Attacks together, since they pair threat identification with the right countermeasures. A strong study habit for this unit is sketching a physical floor plan and labeling where each attack could happen and which device would stop or detect it. That kind of scenario practice is exactly what the FRQ asks you to do. Organized study materials for all four topics are at /ap-cybersecurity/unit-2.