Review AP Cybersecurity Unit 4 to understand how devices are attacked, authenticated, protected, and monitored. This unit covers malware types, hashing and multi-factor authentication, device hardening controls, and log analysis for indicators of compromise.
Use the topic guides, key terms, and practice questions available on Fiveable to work through each concept before your exam.
Every digital device, from a server in a data center to a smart thermostat, can be a target. Unit 4 builds your ability to think like both an attacker and a defender at the device level. You will identify what makes devices vulnerable, explain how authentication systems work and fail, apply protective controls, and analyze logs to catch attacks in progress.
Servers, personal computers, handheld devices, embedded systems, and IoT devices each have distinct attack surfaces. Malware types including viruses, worms, trojans, ransomware, spyware, rootkits, keyloggers, and logic bombs each behave differently and require different detection approaches.
Systems store passwords as salted hashes using algorithms like SHA-256 or NTHash rather than plaintext. Authentication factors include something you know, have, are, or where you are. Password attacks range from online brute force to offline hash cracking, credential stuffing, and password spraying.
Layered device defenses include acceptable use policies, password policies, anti-malware software with signature databases, OS patching, and host-based firewalls with ACL rules. Detection relies on log analysis to find IoCs such as failed logins, unexpected processes, and unauthorized configuration changes.
No single control secures a device. Unit 4 treats device security as overlapping layers: policies set expectations, authentication verifies identity, anti-malware and patching reduce the attack surface, firewalls filter traffic, and logs provide visibility after a breach. Understanding how each layer fails helps you choose the right control for a given scenario.
Covers server, personal, handheld, embedded, and IoT device types; malware behaviors including viruses, worms, trojans, ransomware, spyware, rootkits, keyloggers, and logic bombs; and how to rate vulnerability risk as high, moderate, or low based on device criticality.
Explains cryptographic hashing and salting for password storage, the four authentication factor types, MFA configuration, and how online and offline password attacks, credential stuffing, and password spraying exploit weak authentication.
Covers managerial controls (acceptable use and password policies), anti-malware signature scanning and quarantine, OS and application patching, and host-based firewall rule configuration using ACLs.
Covers log analysis for IoCs, authentication log patterns for brute force and spraying attacks, signature-based versus anomaly-based detection trade-offs, EDR services, and why embedded devices often cannot run local detection tools.
Adversaries target different device categories in different ways. Servers provide services like DNS, DHCP, and FTP to other machines and are high-value targets. Personal computers handle individual work tasks. Handheld devices like smartphones run on battery and have limited security controls. Embedded computers inside appliances and IoT devices often cannot run security software at all. Malware exploits these devices through unpatched software, weak authentication, and missing BIOS or UEFI passwords that allow boot-level access. Risk level depends on how critical the device or its data is.
| Malware Type | Requires User Action? | Primary Effect |
|---|---|---|
| Virus | Yes | Corrupts or destroys files on activation |
| Worm | No | Self-propagates across a network |
| Trojan / RAT | Yes (opens file) | Hides in software; RAT gives remote access |
| Ransomware | No (after delivery) | Encrypts files and demands payment |
| Rootkit | No | Hides deep in OS to maintain persistent access |
Systems store passwords as hashes, not plaintext. A cryptographic hash function takes any input and produces a fixed-length output; SHA-256 and NTHash are common examples. Salting adds a random value before hashing to prevent rainbow table attacks. Authentication factors are categorized as knowledge (password, PIN), possession (access card, authenticator app), biometric (fingerprint, face), and location. Multi-factor authentication (MFA) requires two or more factor types. Password attacks exploit weak authentication: online attacks try combinations against a live login portal; offline attacks crack a stolen hash database without triggering lockouts. Credential stuffing uses leaked username-password pairs; password spraying tries one common password against many accounts.
| Attack Type | Target | Key Indicator in Logs |
|---|---|---|
| Brute force (online) | Single account | Many failed logins for one username |
| Password spraying | Many accounts | Many accounts failing from one IP in seconds |
| Credential stuffing | Many accounts | Default or known user:password pairs attempted rapidly |
| Offline hash cracking | Stolen hash database | No log trail on the victim system |
Device protection layers from policy to technical control. Acceptable use policies define what users may and may not do on organizational devices. Password policies enforce complexity, minimum length, maximum age, and reuse restrictions. Anti-malware software maintains a signature database, scans files, and quarantines matches. Keeping the OS and applications patched closes known vulnerabilities before adversaries can exploit them. A host-based firewall runs on the device itself and applies ACL rules to allow or deny inbound and outbound traffic by port, protocol, source, or destination, providing protection even when the device is on a compromised network.
| Control Type | Example | What It Stops |
|---|---|---|
| Managerial | Acceptable use policy | Risky user behavior on org devices |
| Managerial | Password policy | Weak or reused passwords |
| Technical | Anti-malware software | Known malware via signature matching |
| Technical | OS patching | Exploits targeting known vulnerabilities |
| Technical | Host-based firewall | Unauthorized inbound/outbound traffic by port or IP |
Devices automatically log logins, file activity, process starts, and configuration changes. Analysts review these logs to find indicators of compromise (IoCs): unusual files, unexpected processes, unauthorized config changes, or unauthorized software installs. Authentication logs are the primary source for spotting password attacks. Detection methods are either signature-based (fast, low resource use, misses novel threats) or anomaly-based (catches new threats, uses more resources, higher false positive rate). Endpoint detection and response (EDR) services provide centralized, holistic detection across many devices. Embedded and IoT devices often lack the processing power to run any detection tool locally.
| Detection Method | Speed | Resource Use | False Positives | Best For |
|---|---|---|---|---|
| Signature-based | Fast | Low | Low | Devices with limited processing power |
| Anomaly-based | Slower | High | Higher | Devices where novel threat detection matters |
Try AP-style multiple-choice questions and written prompts after you review the notes.
| Term | Definition |
|---|---|
| malware | Malicious software designed to damage a device, steal data, or give an adversary unauthorized access. |
| ransomware | Malware that encrypts a device's files and demands payment for the decryption key. |
| virus | Malware that activates only when a user executes or opens an infected file. |
| worm | Malware that spreads automatically from device to device without any user interaction. |
| remote access trojan | A trojan that gives an adversary remote command-and-control access to the compromised device. |
| rootkit | Malware that embeds itself deep in the OS to hide its presence and maintain persistent access. |
| keylogger | Malware or hardware that records keystrokes to capture passwords and other sensitive input. |
| BIOS | Firmware that initializes hardware at boot; an unprotected BIOS lets an adversary boot into recovery mode and bypass OS security. |
| patch | A small software update that fixes a specific known vulnerability in an OS or application. |
| anti-malware | Software that scans files against a signature database and quarantines matches to prevent malware from running. |
| knowledge factor | An authentication factor based on something the user knows, such as a password or PIN. |
| possession factor | An authentication factor based on something the user has, such as an access card or authenticator app. |
| logging | Automatic recording of system events including login attempts, file changes, and process activity, used to detect and investigate attacks. |
| EDR | Endpoint Detection and Response; a service providing centralized, unified threat detection and response across an organization's devices. |
| ACL | Access Control List; an ordered set of rules a host-based or network firewall evaluates to allow or deny traffic. |
Viruses require a user to execute or open a file to activate. Worms spread on their own without any user action. In a scenario, the presence or absence of user interaction is the key distinguishing detail.
Hashing is a one-way process; you cannot decrypt a hash to recover the original password. Encryption is reversible with a key. Systems store password hashes precisely because they cannot be reversed.
Account lockout only stops online attacks against a live portal. Once an adversary steals the hash database and cracks it offline, no lockout policy applies because the attack happens on the adversary's own machine.
A host-based firewall protects the device even when it is connected to a compromised or untrusted network where the network-level firewall has already been bypassed.
Embedded and IoT devices often lack the CPU and memory to run anti-malware or anomaly-based detection locally. Recognizing this constraint is part of selecting the right detection approach for a given device type.
AP Cybersecurity questions frequently present a device scenario with a described threat or vulnerability and ask you to identify the most appropriate control. Practice matching malware types to detection methods, attack patterns to authentication weaknesses, and device types to realistic protection options.
Expect questions that present a short log excerpt or event description and ask you to name the attack type, identify the IoC, or explain what the log pattern indicates. Focus on distinguishing brute force, password spraying, and credential stuffing from authentication log data.
Questions may ask you to justify a detection method choice given constraints like device processing power, cost, or the need to catch novel threats. Be ready to explain the speed, resource, and false positive trade-offs between signature-based and anomaly-based detection in the context of a specific device type.
Open the individual guides for Unit 4 when you want a closer review of one topic.
browse guidesAP Cyber Unit 4 covers 4 topics: **4.1 Device Vulnerabilities and Attacks**, **4.2 Authentication**, **4.3 Protecting Devices**, and **4.4 Detecting Attacks on Devices**. You'll learn how adversaries exploit devices, how authentication systems work, how malware operates, and how to read log files for indicators of compromise (IoCs). See the full breakdown at /ap-cybersecurity/unit-4.
The AP Cyber Unit 4 progress check includes MCQ and FRQ parts drawn from all four unit topics: Device Vulnerabilities and Attacks, Authentication, Protecting Devices, and Detecting Attacks on Devices. MCQ questions test your ability to identify attack types and authentication methods, while FRQ questions often ask you to analyze scenarios involving malware, log files, or IoCs. For matched practice questions that mirror the progress check format, visit /ap-cybersecurity/unit-4.
AP Cyber Unit 4 FRQs most often come from Authentication, Protecting Devices, and Detecting Attacks on Devices. These questions typically ask you to analyze a scenario, such as identifying an authentication weakness, explaining how a piece of malware compromises a device, or interpreting a log file for indicators of compromise (IoCs). To practice, work through scenario-based prompts that ask you to justify your reasoning in writing, not just pick an answer. You can find Unit 4 FRQ practice at /ap-cybersecurity/unit-4.
The best place to find AP Cyber Unit 4 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-4. There you'll find MCQs covering Device Vulnerabilities and Attacks, Authentication, Protecting Devices, and Detecting Attacks on Devices, so you can check your understanding of every topic before the exam.
Start Unit 4 by building a solid understanding of the attack types in 4.1, since Device Vulnerabilities and Attacks sets up everything else. Then move to Authentication (4.2) and make sure you can explain how different authentication methods work and where they fail. For 4.3, focus on how anti-malware software and software updates reduce risk. Finish with 4.4 by practicing how to read log files and spot indicators of compromise (IoCs). Use scenario-based practice questions to connect concepts across all four topics. Find study resources at /ap-cybersecurity/unit-4.