Review AP Cybersecurity Unit 5 to understand how adversaries attack applications and data, and how defenders use access controls, cryptography, and detection tools to stop them. This unit covers everything from SQL injection and buffer overflow to AES, RSA, Linux file permissions, and log analysis.
Use the topic guides, key terms, and practice questions available on Fiveable to work through each concept before your exam.
Data is the target. Every attack covered in this unit, whether it steals, modifies, or destroys information, ultimately aims at the confidentiality, integrity, or availability of data and the applications that process it. Unit 5 builds a complete defensive picture: understand the attack, classify the data, apply the right control, encrypt what matters, and detect what gets through.
SQL injection, cross-site scripting (XSS), buffer overflow, and directory traversal all exploit applications that fail to validate or sanitize user input. Unencrypted files and weak access control settings give adversaries easy access to sensitive data without needing a sophisticated exploit.
Symmetric encryption (AES) uses one shared key and is fast for bulk data. Asymmetric encryption (RSA, ECC) uses a public/private key pair so parties can communicate securely without sharing a secret in advance. Key length determines keyspace size: an n-bit key has a keyspace of 2^n, and longer keys are harder to brute-force.
Log analysis (accounting), honeypots, cryptographic hash verification, and data loss prevention (DLP) services form the detection layer. Each tool has trade-offs in cost, speed, and the types of attacks it can catch, including important blind spots like hash functions that cannot detect read-only data theft.
No single control is enough. Unit 5 shows how layering access controls, encryption, secure coding practices, and detective tools creates overlapping protection. When one layer fails, another layer catches the attack or limits its impact. Understanding why each layer exists, and what it cannot do, is the core skill this unit develops.
Covers how SQL injection, XSS, buffer overflow, and directory traversal exploit weak input handling, plus how to assess data vulnerability risk using confidentiality, integrity, and availability.
Covers data states (at rest, in transit, in use), regulated data categories (PII, PHI, PCI), cryptography and web app security policies, access control models (RBAC, RuBAC, MAC, DAC), and Linux chmod file permissions.
Covers how symmetric encryption works, the role of plaintext, ciphertext, and keyspace, AES as the standard symmetric algorithm, and how to encrypt files using OpenSSL on the command line.
Covers public and private key pairs, when to use each key for encryption versus decryption, how key length affects keyspace and brute-force resistance, and how RSA and ECC are applied including digital signatures.
Covers the secure by design and secure by default principles, how input sanitization removes control characters to block injection attacks, and how data validation prevents malformed input from reaching application logic.
Covers log analysis (accounting), honeypots, cryptographic hash verification, and DLP services as detective controls, including how to read logs for SQL injection, XSS, buffer overflow, and directory traversal signatures.
Adversaries exploit three main weaknesses: unencrypted files readable by anyone with device access, overly permissive account privileges that give elevated access when a user account is compromised, and applications that fail to validate user input. The four major injection-style attacks all stem from that last failure.
| Attack | What it exploits | Primary CIA impact |
|---|---|---|
| SQL injection | Unvalidated input passed to a database | Confidentiality / Integrity |
| XSS | Unvalidated input rendered in a browser | Confidentiality |
| Buffer overflow | Input field with no size limit | Integrity / Availability |
| Directory traversal | Unvalidated file path input | Confidentiality |
Protecting data starts with knowing what state it is in and what regulations apply. Organizations then layer managerial policies and access control models on top to limit who can do what to which files.
| Access Control Model | How access is determined | Best used when |
|---|---|---|
| RBAC | Subject's assigned role | Large organizations with defined job functions |
| RuBAC | Evaluation of a rule set | Time-based or context-based restrictions are needed |
| MAC (Mandatory) | Data classification labels matched to subject clearance | High-security environments like government systems |
| DAC (Discretionary) | File owner sets permissions | Small teams where owners manage their own files |
Cryptography hides information by transforming plaintext into ciphertext using an algorithm and a key. Symmetric encryption uses the same key to encrypt and decrypt, making it fast but requiring a secure way to share that key in advance.
Asymmetric encryption solves the key-sharing problem by using a mathematically linked key pair. The public key encrypts; only the matching private key decrypts. This makes secure communication possible between parties who have never met.
| Property | Symmetric (AES) | Asymmetric (RSA / ECC) |
|---|---|---|
| Number of keys | One shared key | Key pair: public and private |
| Key sharing required? | Yes, must share secret key securely | No, public key can be distributed openly |
| Speed | Faster for large data | Slower; typically used for small data or key exchange |
| Common use | File encryption, Wi-Fi, HTTPS bulk data | Digital signatures, certificates, key exchange |
| Example algorithm | AES-256 | RSA-2048, ECC |
Application security begins before a single line of code is written. Secure by design embeds security into every phase of product development. Input sanitization is the technical mechanism that stops injection attacks at the point of entry.
Detective controls identify attacks that preventive controls missed. The main tools are log analysis, honeypots, cryptographic hash verification, and DLP services. Each has different costs, detection speeds, and blind spots that defenders must understand.
| Detective Control | Cost | Detection timing | Key limitation |
|---|---|---|---|
| Log analysis (manual) | Low | Retrospective | Requires human review; slow without automation |
| Automated log analysis | Medium | Real-time | Requires configuration; can produce false positives |
| Honeypot | Low | Near-instant | Only detects adversaries who access the honeypot |
| Cryptographic hash | Low | Retrospective | Cannot detect read-only theft; only detects modification |
| DLP service | High | Real-time | Cost may be prohibitive for smaller organizations |
Try AP-style multiple-choice questions and written prompts after you review the notes.
| Term | Definition |
|---|---|
| SQL injection | An attack where an adversary inserts SQL control words or symbols into an input field to manipulate a database query, potentially reading, modifying, or deleting records. |
| XSS | Cross-site scripting. An attack where malicious script tags are injected into a web application and execute in another user's browser, stealing session data or redirecting the user. |
| encryption | The process of transforming plaintext into ciphertext using a cryptographic algorithm and key so that unauthorized parties cannot read the data. |
| symmetric encryption | An encryption method that uses the same key to both encrypt and decrypt data. AES is the standard symmetric algorithm. |
| asymmetric encryption | An encryption method that uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, eliminating the need to share a secret key in advance. |
| keyspace | The total number of possible keys for a given encryption algorithm. An n-bit key has a keyspace of 2^n; larger keyspaces make brute-force attacks slower. |
| public key | The key in an asymmetric key pair that is shared openly. A sender uses the receiver's public key to encrypt data that only the receiver's private key can decrypt. |
| private key | The key in an asymmetric key pair that must be kept secret. If compromised, the entire key pair must be discarded and a new pair generated. |
| AES | Advanced Encryption Standard. The most widely used symmetric block cipher, encrypting data in 128-bit blocks with key lengths of 128, 192, or 256 bits. |
| RSA | A common asymmetric encryption algorithm used for secure key exchange, digital signatures, and certificates. Typical key lengths are 2048 or 4096 bits. |
| cryptographic hash function | A function that produces a fixed-length output (hash) for any input. The same input always produces the same hash, so a changed hash indicates a file was modified. |
| honeypot | A fake file containing realistic-looking but false sensitive data. Any access attempt triggers an alert because no legitimate user has reason to open it. |
| data loss prevention | A service or tool that monitors data access, usage, and transmission across an organization to detect suspicious activity. Provides strong detection at higher cost than hashing or honeypots. |
| input sanitization | A process that removes or escapes control characters (single quote, double quote, semicolon) from user input before the application processes it, blocking injection attacks. |
| directory traversal | An attack where an adversary uses ../ sequences in a file path to navigate outside the intended directory and access restricted files on a server. |
To send an encrypted message to a receiver, you use the receiver's public key. Only their private key can decrypt it. Students often reverse this. For digital signatures the logic flips: the sender signs with their private key, and anyone with the public key can verify.
An AES 256-bit key and an RSA 256-bit key are not equivalent in security. Key-length comparisons are only valid within the same algorithm. RSA requires much longer keys than AES to achieve comparable security because the underlying math is different.
Hash functions only detect whether a file was modified. If an adversary reads or copies a file without changing it, the hash stays the same and no alert is triggered. This is a critical blind spot that DLP services or log analysis must cover.
Validation checks whether input meets expected criteria (e.g., is it a number?). Sanitization removes or escapes dangerous characters from input. Both are needed, and the exam may ask you to distinguish which technique addresses a specific attack scenario.
The nine characters after the file-type indicator always follow the order owner-group-others, each with rwx. A dash means that permission is absent. Students frequently misassign which segment belongs to which entity, especially when some permissions are missing.
Expect questions that describe a situation, such as a user entering unexpected characters into a web form or an application returning database records it should not, and ask you to name the attack type, explain the vulnerability being exploited, and identify which CIA pillar is affected. Being able to connect the adversary's action to the specific technical weakness is the core skill tested.
Questions may present an organization's data type, regulatory environment, or risk level and ask which access control model, encryption method, or detective control is most appropriate. You will need to justify your choice by explaining why it fits the scenario, not just name the control. Trade-offs such as cost versus detection speed or key length versus performance are common reasoning tasks.
Unit 5 includes hands-on skills: reading Linux permission strings, interpreting log file entries for attack signatures, and understanding command-line syntax for OpenSSL and hash tools. Exam tasks may present a permission string, a log excerpt, or a command and ask you to explain what it shows, what access it grants, or whether it indicates an attack.
Open the individual guides for Unit 5 when you want a closer review of one topic.
browse guidesAP Cyber Unit 5 covers 6 topics: Application and Data Vulnerabilities and Attacks (5.1), Managerial Controls and Access Controls (5.2), Protecting Stored Data with Cryptography (5.3), Asymmetric Cryptography (5.4), Protecting Applications (5.5), and Detecting Attacks on Data and Applications (5.6). The unit focuses on how adversaries target data and how to defend against those attacks. See the full topic list at /ap-cybersecurity/unit-5.
The AP Cyber Unit 5 progress check includes both MCQ and FRQ parts drawn from all 6 topics in the unit. MCQ questions test concepts like access controls, cryptographic methods, and common application vulnerabilities. FRQ prompts typically ask you to analyze an attack scenario or explain a mitigation strategy using topics from 5.1 through 5.6. Practice with matched questions at /ap-cybersecurity/unit-5.
AP Cyber Unit 5 FRQs most often draw from topics on access controls (5.2), cryptography (5.3 and 5.4), and detecting attacks (5.6). These questions ask you to explain a concept, analyze a vulnerability, or recommend a mitigation for a given scenario. To practice, write out full responses to scenario-based prompts and check that you name specific controls or cryptographic techniques. Find practice prompts at /ap-cybersecurity/unit-5.
The best place to find AP Cyber Unit 5 practice questions, including multiple-choice and practice test sets, is /ap-cybersecurity/unit-5. You'll find MCQ questions covering application vulnerabilities, cryptography, and access controls, plus scenario-based questions that mirror the format of the real exam. Practicing by topic first, then mixing question types, builds the most confidence before test day.
Start AP Cyber Unit 5 by building a strong foundation in topic 5.1 (application and data vulnerabilities) before moving into defenses. Then work through access controls (5.2) and both cryptography topics (5.3 and 5.4) together, since symmetric and asymmetric methods connect directly. Finish with 5.5 and 5.6 to understand how to protect and monitor applications. Use scenario-based practice to connect attack types to their mitigations, and review logs and detection methods in 5.6 last since those questions often appear in FRQs. Get topic-by-topic resources at /ap-cybersecurity/unit-5.