Review AP Cybersecurity Unit 5 to understand how adversaries attack applications and data, and how defenders use access controls, cryptography, and detection tools to stop them. This unit covers everything from SQL injection and buffer overflow to AES, RSA, Linux file permissions, and log analysis.
Use the topic guides, key terms, and practice questions available on Fiveable to work through each concept before your exam.
Data is the target. Every attack covered in this unit, whether it steals, modifies, or destroys information, ultimately aims at the confidentiality, integrity, or availability of data and the applications that process it. Unit 5 builds a complete defensive picture: understand the attack, classify the data, apply the right control, encrypt what matters, and detect what gets through.
Unit 5 teaches how adversaries exploit application and file vulnerabilities, how defenders classify data and apply access controls and cryptography to protect it, and how detective controls like log analysis and honeypots identify attacks that succeed.
SQL injection, cross-site scripting (XSS), buffer overflow, and directory traversal all exploit applications that fail to validate or sanitize user input. Unencrypted files and weak access control settings give adversaries easy access to sensitive data without needing a sophisticated exploit.
Symmetric encryption (AES) uses one shared key and is fast for bulk data. Asymmetric encryption (RSA, ECC) uses a public/private key pair so parties can communicate securely without sharing a secret in advance. Key length determines keyspace size: an n-bit key has a keyspace of 2^n, and longer keys are harder to brute-force.
Log analysis (accounting), honeypots, cryptographic hash verification, and data loss prevention (DLP) services form the detection layer. Each tool has trade-offs in cost, speed, and the types of attacks it can catch, including important blind spots like hash functions that cannot detect read-only data theft.
No single control is enough. Unit 5 shows how layering access controls, encryption, secure coding practices, and detective tools creates overlapping protection. When one layer fails, another layer catches the attack or limits its impact. Understanding why each layer exists, and what it cannot do, is the core skill this unit develops.
Covers how SQL injection, XSS, buffer overflow, and directory traversal exploit weak input handling, plus how to assess data vulnerability risk using confidentiality, integrity, and availability.
Covers data states (at rest, in transit, in use), regulated data categories (PII, PHI, PCI), cryptography and web app security policies, access control models (RBAC, RuBAC, MAC, DAC), and Linux chmod file permissions.
Covers how symmetric encryption works, the role of plaintext, ciphertext, and keyspace, AES as the standard symmetric algorithm, and how to encrypt files using OpenSSL on the command line.
Covers public and private key pairs, when to use each key for encryption versus decryption, how key length affects keyspace and brute-force resistance, and how RSA and ECC are applied including digital signatures.
Covers the secure by design and secure by default principles, how input sanitization removes control characters to block injection attacks, and how data validation prevents malformed input from reaching application logic.
Covers log analysis (accounting), honeypots, cryptographic hash verification, and DLP services as detective controls, including how to read logs for SQL injection, XSS, buffer overflow, and directory traversal signatures.
Adversaries exploit three main weaknesses: unencrypted files readable by anyone with device access, overly permissive account privileges that give elevated access when a user account is compromised, and applications that fail to validate user input. The four major injection-style attacks all stem from that last failure.
Can you explain why an application that does not validate user input is vulnerable to all four attack types listed above?
| Attack | What it exploits | Primary CIA impact |
|---|---|---|
| SQL injection | Unvalidated input passed to a database | Confidentiality / Integrity |
| XSS | Unvalidated input rendered in a browser | Confidentiality |
| Buffer overflow | Input field with no size limit | Integrity / Availability |
| Directory traversal | Unvalidated file path input | Confidentiality |
Protecting data starts with knowing what state it is in and what regulations apply. Organizations then layer managerial policies and access control models on top to limit who can do what to which files.
Given a Linux permission string like rw-r--r--, identify what each segment means and which entity it applies to.
| Access Control Model | How access is determined | Best used when |
|---|---|---|
| RBAC | Subject's assigned role | Large organizations with defined job functions |
| RuBAC | Evaluation of a rule set | Time-based or context-based restrictions are needed |
| MAC (Mandatory) | Data classification labels matched to subject clearance | High-security environments like government systems |
| DAC (Discretionary) | File owner sets permissions | Small teams where owners manage their own files |
Cryptography hides information by transforming plaintext into ciphertext using an algorithm and a key. Symmetric encryption uses the same key to encrypt and decrypt, making it fast but requiring a secure way to share that key in advance.
Why does a longer AES key length increase security, and what is the trade-off?
Asymmetric encryption solves the key-sharing problem by using a mathematically linked key pair. The public key encrypts; only the matching private key decrypts. This makes secure communication possible between parties who have never met.
A sender wants to encrypt a message so only the receiver can read it. Which key does the sender use, and why?
| Property | Symmetric (AES) | Asymmetric (RSA / ECC) |
|---|---|---|
| Number of keys | One shared key | Key pair: public and private |
| Key sharing required? | Yes, must share secret key securely | No, public key can be distributed openly |
| Speed | Faster for large data | Slower; typically used for small data or key exchange |
| Common use | File encryption, Wi-Fi, HTTPS bulk data | Digital signatures, certificates, key exchange |
| Example algorithm | AES-256 | RSA-2048, ECC |
Application security begins before a single line of code is written. Secure by design embeds security into every phase of product development. Input sanitization is the technical mechanism that stops injection attacks at the point of entry.
How does input sanitization specifically prevent a SQL injection attack?
Detective controls identify attacks that preventive controls missed. The main tools are log analysis, honeypots, cryptographic hash verification, and DLP services. Each has different costs, detection speeds, and blind spots that defenders must understand.
An adversary reads a sensitive file but does not modify it. Which detection tools would catch this, and which would not?
| Detective Control | Cost | Detection timing | Key limitation |
|---|---|---|---|
| Log analysis (manual) | Low | Retrospective | Requires human review; slow without automation |
| Automated log analysis | Medium | Real-time | Requires configuration; can produce false positives |
| Honeypot | Low | Near-instant | Only detects adversaries who access the honeypot |
| Cryptographic hash | Low | Retrospective | Cannot detect read-only theft; only detects modification |
| DLP service | High | Real-time | Cost may be prohibitive for smaller organizations |
Try AP-style multiple-choice questions and written prompts after you review the notes.
A timed, AP-style test built only from unit 5 questions — multiple choice plus free response, scored with AI feedback. Use the standard format or build your own.
| Term | Definition |
|---|---|
| SQL injection | An attack where an adversary inserts SQL control words or symbols into an input field to manipulate a database query, potentially reading, modifying, or deleting records. |
| XSS | Cross-site scripting. An attack where malicious script tags are injected into a web application and execute in another user's browser, stealing session data or redirecting the user. |
| encryption | The process of transforming plaintext into ciphertext using a cryptographic algorithm and key so that unauthorized parties cannot read the data. |
| symmetric encryption | An encryption method that uses the same key to both encrypt and decrypt data. AES is the standard symmetric algorithm. |
| asymmetric encryption | An encryption method that uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, eliminating the need to share a secret key in advance. |
| keyspace | The total number of possible keys for a given encryption algorithm. An n-bit key has a keyspace of 2^n; larger keyspaces make brute-force attacks slower. |
| public key | The key in an asymmetric key pair that is shared openly. A sender uses the receiver's public key to encrypt data that only the receiver's private key can decrypt. |
| private key | The key in an asymmetric key pair that must be kept secret. If compromised, the entire key pair must be discarded and a new pair generated. |
| AES | Advanced Encryption Standard. The most widely used symmetric block cipher, encrypting data in 128-bit blocks with key lengths of 128, 192, or 256 bits. |
| RSA | A common asymmetric encryption algorithm used for secure key exchange, digital signatures, and certificates. Typical key lengths are 2048 or 4096 bits. |
| cryptographic hash function | A function that produces a fixed-length output (hash) for any input. The same input always produces the same hash, so a changed hash indicates a file was modified. |
| honeypot | A fake file containing realistic-looking but false sensitive data. Any access attempt triggers an alert because no legitimate user has reason to open it. |
| data loss prevention | A service or tool that monitors data access, usage, and transmission across an organization to detect suspicious activity. Provides strong detection at higher cost than hashing or honeypots. |
| input sanitization | A process that removes or escapes control characters (single quote, double quote, semicolon) from user input before the application processes it, blocking injection attacks. |
| directory traversal | An attack where an adversary uses ../ sequences in a file path to navigate outside the intended directory and access restricted files on a server. |
To send an encrypted message to a receiver, you use the receiver's public key. Only their private key can decrypt it. Students often reverse this. For digital signatures the logic flips: the sender signs with their private key, and anyone with the public key can verify.
An AES 256-bit key and an RSA 256-bit key are not equivalent in security. Key-length comparisons are only valid within the same algorithm. RSA requires much longer keys than AES to achieve comparable security because the underlying math is different.
Hash functions only detect whether a file was modified. If an adversary reads or copies a file without changing it, the hash stays the same and no alert is triggered. This is a critical blind spot that DLP services or log analysis must cover.
Validation checks whether input meets expected criteria (e.g., is it a number?). Sanitization removes or escapes dangerous characters from input. Both are needed, and the exam may ask you to distinguish which technique addresses a specific attack scenario.
The nine characters after the file-type indicator always follow the order owner-group-others, each with rwx. A dash means that permission is absent. Students frequently misassign which segment belongs to which entity, especially when some permissions are missing.
Expect questions that describe a situation, such as a user entering unexpected characters into a web form or an application returning database records it should not, and ask you to name the attack type, explain the vulnerability being exploited, and identify which CIA pillar is affected. Being able to connect the adversary's action to the specific technical weakness is the core skill tested.
Questions may present an organization's data type, regulatory environment, or risk level and ask which access control model, encryption method, or detective control is most appropriate. You will need to justify your choice by explaining why it fits the scenario, not just name the control. Trade-offs such as cost versus detection speed or key length versus performance are common reasoning tasks.
Unit 5 includes hands-on skills: reading Linux permission strings, interpreting log file entries for attack signatures, and understanding command-line syntax for OpenSSL and hash tools. Exam tasks may present a permission string, a log excerpt, or a command and ask you to explain what it shows, what access it grants, or whether it indicates an attack.
For each of SQL injection, XSS, buffer overflow, and directory traversal, describe what the adversary sends, what vulnerability they exploit, and which CIA pillar is most affected.
Distinguish data at rest, in transit, and in use, and identify which security controls apply to each. Know what PII, PHI, and PCI mean and why each category carries legal obligations.
Compare RBAC, RuBAC, MAC, and DAC. Given a scenario, select the appropriate model and justify the choice. Read and interpret Linux permission strings like rwxr-x--- and apply chmod to set permissions.
Explain how AES encrypts data in 128-bit blocks using a shared key. Explain how RSA and ECC use key pairs. Calculate keyspace as 2^n and estimate average brute-force guesses as 2^(n-1). Know that key-length comparisons only apply within the same algorithm.
State the three secure by design principles and explain what secure by default means. Explain how removing control characters (single quote, double quote, semicolon) through input sanitization blocks injection attacks.
Compare log analysis, honeypots, cryptographic hashes, and DLP on cost, detection timing, and limitations. Know that hash functions detect modification but not read-only theft, and that honeypots only catch adversaries who access them.
Identify SQL injection indicators (OR 1=1, --, SQL keywords), XSS indicators (
Read the Topic 5.1 guide and list all four attack types with a one-sentence explanation of what each adversary does and what vulnerability they exploit. Then practice rating a scenario as high, moderate, or low risk using the CIA framework.
Review the three data states and the PII, PHI, and PCI categories. Then compare the four access control models in a table. Finish by practicing Linux permission strings: read a permission string, then write the chmod command that would produce it.
Study symmetric encryption first: how AES works, what keyspace means, and the 2^n formula. Then move to asymmetric: draw a diagram of a key pair exchange showing which key is used at each step. Practice the keyspace math with sample bit lengths.
State the three secure by design principles from memory. Then trace how a SQL injection attack would be stopped at each stage: validation rejects unexpected input, sanitization strips control characters. Connect this back to the attacks from Topic 5.1.
Compare the four detective controls on cost, timing, and limitations using the comparison table in the review notes. Then practice identifying attack signatures: given a sample log entry, determine whether it shows SQL injection, XSS, buffer overflow, or directory traversal.
Open the individual guides for Unit 5 when you want a closer review of one topic.
Use AP-style practice after you review the notes so you can check what you understand.
Practice free-response reasoning and compare your answer with scoring guidance.
Estimate your broader AP score goal after you review the course and exam format.
Print the unit cheatsheets ($3) or unit exams ($5) for Unit 5. Yours to keep, no subscription needed.
get printablesAP Cyber Unit 5 covers 6 topics: Application and Data Vulnerabilities and Attacks (5.1), Managerial Controls and Access Controls (5.2), Protecting Stored Data with Cryptography (5.3), Asymmetric Cryptography (5.4), Protecting Applications (5.5), and Detecting Attacks on Data and Applications (5.6). The unit focuses on how adversaries target data and how to defend against those attacks. See the full topic list at /ap-cybersecurity/unit-5.
The AP Cyber Unit 5 progress check includes both MCQ and FRQ parts drawn from all 6 topics in the unit. MCQ questions test concepts like access controls, cryptographic methods, and common application vulnerabilities. FRQ prompts typically ask you to analyze an attack scenario or explain a mitigation strategy using topics from 5.1 through 5.6. Practice with matched questions at /ap-cybersecurity/unit-5.
AP Cyber Unit 5 FRQs most often draw from topics on access controls (5.2), cryptography (5.3 and 5.4), and detecting attacks (5.6). These questions ask you to explain a concept, analyze a vulnerability, or recommend a mitigation for a given scenario. To practice, write out full responses to scenario-based prompts and check that you name specific controls or cryptographic techniques. Find practice prompts at /ap-cybersecurity/unit-5.
The best place to find AP Cyber Unit 5 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-5. You'll find MCQ questions covering application vulnerabilities, cryptography, and access controls, plus scenario-based questions that mirror the format of the real exam. Practicing by topic first, then mixing question types, builds the most confidence before test day.
Start AP Cyber Unit 5 by building a strong foundation in topic 5.1 (application and data vulnerabilities) before moving into defenses. Then work through access controls (5.2) and both cryptography topics (5.3 and 5.4) together, since symmetric and asymmetric methods connect directly. Finish with 5.5 and 5.6 to understand how to protect and monitor applications. Use scenario-based practice to connect attack types to their mitigations, and review logs and detection methods in 5.6 last since those questions often appear in FRQs. Get topic-by-topic resources at /ap-cybersecurity/unit-5.