Review AP Cybersecurity Unit 4 to understand how devices are attacked, authenticated, protected, and monitored. This unit covers malware types, hashing and multi-factor authentication, device hardening controls, and log analysis for indicators of compromise.
Use the topic guides, key terms, and practice questions available on Fiveable to work through each concept before your exam.
Every digital device, from a server in a data center to a smart thermostat, can be a target. Unit 4 builds your ability to think like both an attacker and a defender at the device level. You will identify what makes devices vulnerable, explain how authentication systems work and fail, apply protective controls, and analyze logs to catch attacks in progress.
Unit 4 is about securing individual computing devices. It covers the types of malware adversaries use, how authentication mechanisms verify users, the controls that harden devices against attack, and how to read authentication and system logs to detect indicators of compromise.
Servers, personal computers, handheld devices, embedded systems, and IoT devices each have distinct attack surfaces. Malware types including viruses, worms, trojans, ransomware, spyware, rootkits, keyloggers, and logic bombs each behave differently and require different detection approaches.
Systems store passwords as salted hashes using algorithms like SHA-256 or NTHash rather than plaintext. Authentication factors include something you know, have, are, or where you are. Password attacks range from online brute force to offline hash cracking, credential stuffing, and password spraying.
Layered device defenses include acceptable use policies, password policies, anti-malware software with signature databases, OS patching, and host-based firewalls with ACL rules. Detection relies on log analysis to find IoCs such as failed logins, unexpected processes, and unauthorized configuration changes.
No single control secures a device. Unit 4 treats device security as overlapping layers: policies set expectations, authentication verifies identity, anti-malware and patching reduce the attack surface, firewalls filter traffic, and logs provide visibility after a breach. Understanding how each layer fails helps you choose the right control for a given scenario.
Covers server, personal, handheld, embedded, and IoT device types; malware behaviors including viruses, worms, trojans, ransomware, spyware, rootkits, keyloggers, and logic bombs; and how to rate vulnerability risk as high, moderate, or low based on device criticality.
Explains cryptographic hashing and salting for password storage, the four authentication factor types, MFA configuration, and how online and offline password attacks, credential stuffing, and password spraying exploit weak authentication.
Covers managerial controls (acceptable use and password policies), anti-malware signature scanning and quarantine, OS and application patching, and host-based firewall rule configuration using ACLs.
Covers log analysis for IoCs, authentication log patterns for brute force and spraying attacks, signature-based versus anomaly-based detection trade-offs, EDR services, and why embedded devices often cannot run local detection tools.
Adversaries target different device categories in different ways. Servers provide services like DNS, DHCP, and FTP to other machines and are high-value targets. Personal computers handle individual work tasks. Handheld devices like smartphones run on battery and have limited security controls. Embedded computers inside appliances and IoT devices often cannot run security software at all. Malware exploits these devices through unpatched software, weak authentication, and missing BIOS or UEFI passwords that allow boot-level access. Risk level depends on how critical the device or its data is.
Can you classify a described malware behavior as a virus, worm, trojan, ransomware, spyware, rootkit, keylogger, or logic bomb, and rate the associated risk as high, moderate, or low based on the device type and data involved?
| Malware Type | Requires User Action? | Primary Effect |
|---|---|---|
| Virus | Yes | Corrupts or destroys files on activation |
| Worm | No | Self-propagates across a network |
| Trojan / RAT | Yes (opens file) | Hides in software; RAT gives remote access |
| Ransomware | No (after delivery) | Encrypts files and demands payment |
| Rootkit | No | Hides deep in OS to maintain persistent access |
Systems store passwords as hashes, not plaintext. A cryptographic hash function takes any input and produces a fixed-length output; SHA-256 and NTHash are common examples. Salting adds a random value before hashing to prevent rainbow table attacks. Authentication factors are categorized as knowledge (password, PIN), possession (access card, authenticator app), biometric (fingerprint, face), and location. Multi-factor authentication (MFA) requires two or more factor types. Password attacks exploit weak authentication: online attacks try combinations against a live login portal; offline attacks crack a stolen hash database without triggering lockouts. Credential stuffing uses leaked username-password pairs; password spraying tries one common password against many accounts.
Given a scenario, can you identify which authentication factor type is being used, explain why salted hashes are stored instead of plaintext, and classify a described attack as brute force, credential stuffing, or password spraying?
| Attack Type | Target | Key Indicator in Logs |
|---|---|---|
| Brute force (online) | Single account | Many failed logins for one username |
| Password spraying | Many accounts | Many accounts failing from one IP in seconds |
| Credential stuffing | Many accounts | Default or known user:password pairs attempted rapidly |
| Offline hash cracking | Stolen hash database | No log trail on the victim system |
Device protection layers from policy to technical control. Acceptable use policies define what users may and may not do on organizational devices. Password policies enforce complexity, minimum length, maximum age, and reuse restrictions. Anti-malware software maintains a signature database, scans files, and quarantines matches. Keeping the OS and applications patched closes known vulnerabilities before adversaries can exploit them. A host-based firewall runs on the device itself and applies ACL rules to allow or deny inbound and outbound traffic by port, protocol, source, or destination, providing protection even when the device is on a compromised network.
Can you explain why a host-based firewall adds value even when a network firewall exists, and describe what happens when anti-malware software finds a file matching a known signature?
| Control Type | Example | What It Stops |
|---|---|---|
| Managerial | Acceptable use policy | Risky user behavior on org devices |
| Managerial | Password policy | Weak or reused passwords |
| Technical | Anti-malware software | Known malware via signature matching |
| Technical | OS patching | Exploits targeting known vulnerabilities |
| Technical | Host-based firewall | Unauthorized inbound/outbound traffic by port or IP |
Devices automatically log logins, file activity, process starts, and configuration changes. Analysts review these logs to find indicators of compromise (IoCs): unusual files, unexpected processes, unauthorized config changes, or unauthorized software installs. Authentication logs are the primary source for spotting password attacks. Detection methods are either signature-based (fast, low resource use, misses novel threats) or anomaly-based (catches new threats, uses more resources, higher false positive rate). Endpoint detection and response (EDR) services provide centralized, holistic detection across many devices. Embedded and IoT devices often lack the processing power to run any detection tool locally.
Given a log excerpt showing repeated failed logins for one account, can you identify the attack type, name the IoC, and explain why signature-based detection is preferred on resource-limited embedded devices?
| Detection Method | Speed | Resource Use | False Positives | Best For |
|---|---|---|---|---|
| Signature-based | Fast | Low | Low | Devices with limited processing power |
| Anomaly-based | Slower | High | Higher | Devices where novel threat detection matters |
Try AP-style multiple-choice questions and written prompts after you review the notes.
A timed, AP-style test built only from unit 4 questions — multiple choice plus free response, scored with AI feedback. Use the standard format or build your own.
| Term | Definition |
|---|---|
| malware | Malicious software designed to damage a device, steal data, or give an adversary unauthorized access. |
| ransomware | Malware that encrypts a device's files and demands payment for the decryption key. |
| virus | Malware that activates only when a user executes or opens an infected file. |
| worm | Malware that spreads automatically from device to device without any user interaction. |
| remote access trojan | A trojan that gives an adversary remote command-and-control access to the compromised device. |
| rootkit | Malware that embeds itself deep in the OS to hide its presence and maintain persistent access. |
| keylogger | Malware or hardware that records keystrokes to capture passwords and other sensitive input. |
| BIOS | Firmware that initializes hardware at boot; an unprotected BIOS lets an adversary boot into recovery mode and bypass OS security. |
| patch | A small software update that fixes a specific known vulnerability in an OS or application. |
| anti-malware | Software that scans files against a signature database and quarantines matches to prevent malware from running. |
| knowledge factor | An authentication factor based on something the user knows, such as a password or PIN. |
| possession factor | An authentication factor based on something the user has, such as an access card or authenticator app. |
| logging | Automatic recording of system events including login attempts, file changes, and process activity, used to detect and investigate attacks. |
| EDR | Endpoint Detection and Response; a service providing centralized, unified threat detection and response across an organization's devices. |
| ACL | Access Control List; an ordered set of rules a host-based or network firewall evaluates to allow or deny traffic. |
Viruses require a user to execute or open a file to activate. Worms spread on their own without any user action. In a scenario, the presence or absence of user interaction is the key distinguishing detail.
Hashing is a one-way process; you cannot decrypt a hash to recover the original password. Encryption is reversible with a key. Systems store password hashes precisely because they cannot be reversed.
Account lockout only stops online attacks against a live portal. Once an adversary steals the hash database and cracks it offline, no lockout policy applies because the attack happens on the adversary's own machine.
A host-based firewall protects the device even when it is connected to a compromised or untrusted network where the network-level firewall has already been bypassed.
Embedded and IoT devices often lack the CPU and memory to run anti-malware or anomaly-based detection locally. Recognizing this constraint is part of selecting the right detection approach for a given device type.
AP Cybersecurity questions frequently present a device scenario with a described threat or vulnerability and ask you to identify the most appropriate control. Practice matching malware types to detection methods, attack patterns to authentication weaknesses, and device types to realistic protection options.
Expect questions that present a short log excerpt or event description and ask you to name the attack type, identify the IoC, or explain what the log pattern indicates. Focus on distinguishing brute force, password spraying, and credential stuffing from authentication log data.
Questions may ask you to justify a detection method choice given constraints like device processing power, cost, or the need to catch novel threats. Be ready to explain the speed, resource, and false positive trade-offs between signature-based and anomaly-based detection in the context of a specific device type.
Be able to distinguish servers, personal computers, handheld devices, embedded systems, and IoT devices and explain why each has a different vulnerability profile.
Given a scenario description, name the malware type: virus (user activation), worm (self-spreading), trojan or RAT (hidden in software), ransomware (encrypts files), spyware, rootkit, keylogger, or logic bomb.
Describe why systems store salted hashes instead of plaintext, name at least two hash algorithms (SHA-256, NTHash), and explain collision resistance and pre-image resistance.
Classify a given authentication mechanism as knowledge, possession, biometric, or location, and explain how MFA combines factor types to reduce risk from a stolen password.
Match a given threat to the appropriate control: acceptable use policy, password policy, anti-malware, patching, or host-based firewall rule, and explain what each control blocks.
Identify brute force (many failures on one account), password spraying (many accounts failing from one IP), and credential stuffing (default pairs attempted rapidly) from log data.
Explain the trade-offs in speed, resource use, and false positive rate, and justify which method fits a resource-limited embedded device versus a high-value server.
Read the Topic 4.1 guide and practice naming each malware type from a behavior description. Build a quick reference table of malware types, how they spread, and what they do, then use the available practice questions to test your classification speed.
Read the Topic 4.2 guide focusing on the hashing and salting process, the four factor types, and the four password attack patterns. Draw the flow from plaintext password to salted hash storage, then practice identifying attack types from log-style scenario descriptions.
Read the Topic 4.3 guide and for each control (acceptable use policy, password policy, anti-malware, patching, host-based firewall) write one sentence explaining what specific threat it addresses. Practice writing a firewall ACL rule that blocks a named port or service.
Read the Topic 4.4 guide and work through any log-reading practice questions. Focus on matching log patterns to attack types and on explaining why signature-based detection is preferred on low-resource devices. Review the comparison between signature-based and anomaly-based detection trade-offs.
Pick a device type, describe a plausible attack path from initial vulnerability through malware delivery, explain which authentication weakness was exploited, name the controls that could have prevented it, and identify the IoC that would appear in the logs.
Open the individual guides for Unit 4 when you want a closer review of one topic.
Use AP-style practice after you review the notes so you can check what you understand.
Practice free-response reasoning and compare your answer with scoring guidance.
Estimate your broader AP score goal after you review the course and exam format.
Print the unit cheatsheets ($3) or unit exams ($5) for Unit 4. Yours to keep, no subscription needed.
get printablesAP Cyber Unit 4 covers 4 topics: **4.1 Device Vulnerabilities and Attacks**, **4.2 Authentication**, **4.3 Protecting Devices**, and **4.4 Detecting Attacks on Devices**. You'll learn how adversaries exploit devices, how authentication systems work, how malware operates, and how to read log files for indicators of compromise (IoCs). See the full breakdown at /ap-cybersecurity/unit-4.
The AP Cyber Unit 4 progress check includes MCQ and FRQ parts drawn from all four unit topics: Device Vulnerabilities and Attacks, Authentication, Protecting Devices, and Detecting Attacks on Devices. MCQ questions test your ability to identify attack types and authentication methods, while FRQ questions often ask you to analyze scenarios involving malware, log files, or IoCs. For matched practice questions that mirror the progress check format, visit /ap-cybersecurity/unit-4.
AP Cyber Unit 4 FRQs most often come from Authentication, Protecting Devices, and Detecting Attacks on Devices. These questions typically ask you to analyze a scenario, such as identifying an authentication weakness, explaining how a piece of malware compromises a device, or interpreting a log file for indicators of compromise (IoCs). To practice, work through scenario-based prompts that ask you to justify your reasoning in writing, not just pick an answer. You can find Unit 4 FRQ practice at /ap-cybersecurity/unit-4.
The best place to find AP Cyber Unit 4 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-4. There you'll find MCQs covering Device Vulnerabilities and Attacks, Authentication, Protecting Devices, and Detecting Attacks on Devices, so you can check your understanding of every topic before the exam.
Start Unit 4 by building a solid understanding of the attack types in 4.1, since Device Vulnerabilities and Attacks sets up everything else. Then move to Authentication (4.2) and make sure you can explain how different authentication methods work and where they fail. For 4.3, focus on how anti-malware software and software updates reduce risk. Finish with 4.4 by practicing how to read log files and spot indicators of compromise (IoCs). Use scenario-based practice questions to connect concepts across all four topics. Find study resources at /ap-cybersecurity/unit-4.
sudo tail -n 15 /var/log/auth.log
1 Oct 24 08:12:01 webserver CRON[4122]: pam_unix(cron:session): session opened for user root
2 Oct 24 08:12:01 webserver CRON[4122]: pam_unix(cron:session): session closed for user root
3 Oct 24 09:14:22 webserver sshd[5021]: Failed password for invalid user admin from 203.0.113.50 port 49211 ssh2
4 Oct 24 09:14:24 webserver sshd[5023]: Failed password for invalid user root from 203.0.113.50 port 49215 ssh2
5 Oct 24 09:14:25 webserver sshd[5025]: Failed password for invalid user ubuntu from 203.0.113.50 port 49218 ssh2
6 Oct 24 09:14:27 webserver sshd[5027]: Failed password for invalid user test from 203.0.113.50 port 49220 ssh2
7 Oct 24 09:14:28 webserver sshd[5029]: Failed password for invalid user admin from 203.0.113.50 port 49223 ssh2
8 Oct 24 09:14:30 webserver sshd[5031]: Failed password for invalid user user from 203.0.113.50 port 49225 ssh2
9 Oct 24 09:14:31 webserver sshd[5033]: Failed password for invalid user root from 203.0.113.50 port 49228 ssh2
10 Oct 24 09:14:33 webserver sshd[5035]: Failed password for invalid user support from 203.0.113.50 port 49230 ssh2
11 Oct 24 10:05:12 webserver kernel: [12456.789012] [UFW BLOCK] IN=eth0 OUT= MAC=00:1a:2b:3c:4d:5e SRC=198.51.100.22 DST=192.168.5.100 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41234 DF PROTO=TCP SPT=51342 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
12 Oct 24 10:05:15 webserver kernel: [12459.123456] [UFW BLOCK] IN=eth0 OUT= MAC=00:1a:2b:3c:4d:5e SRC=198.51.100.22 DST=192.168.5.100 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41235 DF PROTO=TCP SPT=51342 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
13 Oct 24 10:15:01 webserver sshd[5100]: Accepted publickey for admin from 192.168.5.45 port 55214 ssh2
14 Oct 24 10:15:01 webserver sshd[5100]: pam_unix(sshd:session): session opened for user admin
15 Oct 24 10:20:01 webserver CRON[5120]: pam_unix(cron:session): session opened for user rootsudo tail -n 8 /var/log/nginx/access.log
1 192.168.5.45 - - [24/Oct/2024:11:01:22 +0000] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"
2 192.168.5.45 - - [24/Oct/2024:11:01:25 +0000] "GET /css/style.css HTTP/1.1" 200 512 "http://192.168.5.100/index.html" "Mozilla/5.0"
3 198.51.100.77 - - [24/Oct/2024:11:05:10 +0000] "GET /images/logo.png HTTP/1.1" 200 4096 "-" "curl/7.68.0"
4 198.51.100.77 - - [24/Oct/2024:11:05:12 +0000] "GET /images/../../../etc/passwd HTTP/1.1" 400 154 "-" "curl/7.68.0"
5 198.51.100.77 - - [24/Oct/2024:11:05:13 +0000] "GET /images/../../../../etc/shadow HTTP/1.1" 400 154 "-" "curl/7.68.0"
6 198.51.100.77 - - [24/Oct/2024:11:05:15 +0000] "GET /images/../../../var/www/html/config.php HTTP/1.1" 200 842 "-" "curl/7.68.0"
7 192.168.5.88 - - [24/Oct/2024:11:10:05 +0000] "POST /login.php HTTP/1.1" 302 0 "-" "Mozilla/5.0"
8 192.168.5.88 - - [24/Oct/2024:11:10:06 +0000] "GET /dashboard.php HTTP/1.1" 200 2048 "-" "Mozilla/5.0"ls -l /var/www/html
-rw-r--r-- 1 www-data www-data 1024 Oct 20 09:15 index.html
-rw-r--r-- 1 www-data www-data 512 Oct 20 09:15 login.php
-rw-r--r-- 1 www-data www-data 2048 Oct 20 09:15 dashboard.php
-rw-rw-rw- 1 www-data www-data 842 Oct 21 14:30 config.php
drwxr-xr-x 2 www-data www-data 4096 Oct 20 09:15 images
drwxr-xr-x 2 www-data www-data 4096 Oct 20 09:15 css