AP Cybersecurity Unit 1 practice questions
Try 10 multiple-choice questions from Unit 1 here. Pick an answer to see why it's right or wrong, then take the timed test above for a full AP-style set.
Question 1
From: it-security-alerts@nexcorptech-helpdesk.net To: j.waller@nexcorp-internal.com Date: Thu, 12 Sep 2024 08:47:33 -0500 Subject: URGENT: Unauthorized Login Detected – Immediate Verification Required Reply-To: verify-account@nexcorptech-helpdesk.net X-Originating-IP: 203.0.113.47 X-Mailer: PHPMailer 5.2.0 Message-ID: 8821.203.0.113.47.1726144053@nexcorptech-helpdesk.net
NexCorp Employee Security Services
Dear J. Waller,
Our systems have detected an unauthorized login attempt on your NexCorp account originating from an unrecognized device in a foreign location.
Your account has been TEMPORARILY SUSPENDED to protect company data.
You MUST verify your identity within the next 30 MINUTES or your account will be permanently locked and your manager will be notified of the security violation.
To restore access immediately, click the link below and enter your employee credentials along with the one-time passcode (OTP) sent to your registered mobile device:
</>Codehttp://nexcorp-verify-login.net/account/restore?uid=jwallerIf you do not act within the allotted time, IT Security will escalate this incident to your department head and initiate a formal review of your account activity.
Do NOT share this message with colleagues, as doing so may further delay restoration of your access.
For questions, reply directly to this email.
Regards, NexCorp IT Security Team Employee Help Desk | Extension 0-HELP nexcorp-internal.com
This message is confidential and intended only for the named recipient.
Which of the following characteristics of the provided email most clearly indicates a social engineering attack method designed to bypass logical scrutiny?
The instruction to avoid sharing the message combined with a strict time limit.
The use of an unencrypted HTTP link rather than HTTPS for the restoration portal.
The inclusion of the recipient's specific username within the restoration URL string.
The mismatch between the sender's email domain and the recipient's internal domain.
Show answer
Answer: (A)
Social engineering attacks frequently rely on psychological manipulation. The stimulus explicitly uses isolation and urgency to force a mistake, which is the primary method used to generate risk by bypassing human logical defenses.
Question 2
A company's voice authentication system is compromised when an adversary uses a cloned voice recording to log in as an executive. Which defense would have been most effective at preventing this specific account takeover?
Requiring a second verification factor such as a one-time code sent to a registered device
Upgrading the voice recognition software to a newer model trained on more audio samples
Requiring employees to change their voice authentication passphrase every 90 days on a rotating schedule
Restricting voice authentication access to calls made from company-issued phone numbers only
Show answer
Answer: (A)
Recognizing that voice cloning defeats single-factor voice authentication points directly to multifactor authentication (MFA) as the solution. Even if the adversary perfectly clones the executive's voice, MFA requires a second factor—such as a code sent to a registered phone—that the attacker cannot replicate, blocking the account takeover.
Question 3
A financial analyst pastes a client's account numbers and transaction history into a public AI chatbot to summarize the data. A cybersecurity auditor flags this as a serious risk. Which specific threat does the auditor's concern most directly address?
Adversaries could later extract the client data by crafting targeted prompts if the tool uses input for continuous model training
Adversaries could intercept the analyst's internet connection and read the chatbot session in real time during transmission
Adversaries could use the chatbot's output to generate phishing messages targeting the analyst's organization
Adversaries could poison the chatbot's training data by publishing false financial information on public websites
Show answer
Answer: (A)
Identifying that some AI tools feed user input back into the model for continuous training is the key analytical step. Once sensitive data enters the training pipeline, adversaries can craft prompts designed to extract that data from the model, making the client's financial information accessible to unauthorized parties.
Question 4
A family establishes a shared secret code word after learning that AI voice-cloning tools can convincingly impersonate relatives over the phone. A few weeks later, a family member receives a call from someone using a cloned voice asking for an emergency wire transfer. How does the shared secret defend against this specific AI-augmented attack?
The secret word authenticates identity because a voice clone built from public recordings cannot know a privately agreed-upon phrase
The secret word encrypts the phone call so the adversary cannot intercept the conversation during transmission
The secret word alerts the phone carrier to flag the call as suspicious and automatically block the transfer request
The secret word trains the family's devices to recognize the adversary's cloned voice and reject future calls automatically
Show answer
Answer: (A)
Analyzing why the shared secret works requires recognizing that AI voice cloning draws on publicly available audio samples—social media videos, interviews, voicemails—but cannot access information that was never made public. A word or phrase agreed upon privately between two people is outside the adversary's data set, so the clone fails the authentication test even if the voice sounds perfect.
Question 5
A security analyst notices that an AI-powered research assistant used by the company's legal team has begun citing a specific court ruling that does not appear in any official legal database or established news archive. The analyst suspects the AI may be repeating false information introduced through training data manipulation. Which combination of actions best addresses both detecting this threat and protecting against its consequences?
Cross-reference the AI's output against official court databases and non-AI legal sources, then restrict staff from entering case details into the tool
Retrain the AI model immediately using only internal documents, then enable multifactor authentication on the research tool's login portal
Ask the AI tool to regenerate its answer using a different prompt, then compare both outputs to determine which version is more accurate
Report the false citation to the AI vendor for correction, then establish a shared secret among legal staff to verify AI-generated documents internally
Show answer
Answer: (A)
Detecting a potential data-poisoning attack requires verifying AI output against reputable, stable, non-AI-based sources—here, official court databases—because poisoned training data causes the model to repeat false information confidently. Restricting staff from entering case details addresses the separate but related risk that sensitive legal data entered into the tool could be extracted later by adversaries, combining both the detection and protection defenses from EK 1.4.B.3 and 1.4.B.4.
Question 6
A victim responds to a text message claiming to be from their bank, providing their full name, home address, and date of birth to 'verify their identity.' Which impact does this most directly enable for the adversary?
Impersonating the victim by answering identity challenge questions on account recovery pages
Logging in to the victim's bank account immediately by using the disclosed details as a password
Installing malware on the victim's device by transmitting the personal details as a malicious payload
Intercepting future one-time passwords sent to the victim by rerouting their phone number
Show answer
Answer: (A)
Connecting the disclosed personal details to their specific use in account recovery reveals the core risk. Name, address, and birthdate are precisely the fields websites use as challenge questions to verify a user's identity, so an adversary who collects them can impersonate the victim to reset passwords and take over accounts.
Question 7
An adversary calls a victim, claims to be from a streaming service's support team, and says suspicious login activity was detected. The adversary then asks the victim to read back the six-digit code just sent to their phone 'to confirm their identity.' What is the most likely outcome if the victim complies?
The adversary uses the code to complete a login they initiated, gaining full access to the victim's account
The adversary installs malware on the victim's device by transmitting the code as a malicious script
The adversary captures the victim's saved browser passwords by using the code to access stored credentials
The adversary redirects the victim to a fake login page by linking the code to a phishing website
Show answer
Answer: (A)
Recognizing that the adversary triggered the one-time password by attempting to log in as the victim exposes the mechanism. The six-digit code is an authentication code the service sent in response to the adversary's own login attempt; reading it aloud hands the adversary the final piece needed to authenticate as the victim and take over the account.
Question 8
A user receives an email with the subject line 'Invoice Attached – Action Required' and opens the attached file to review it. The file silently runs a program that records every website login the user types over the next week. Which category of social engineering impact does this scenario illustrate?
Malware installed through a deceptive attachment captures login credentials entered in the browser
Personal information disclosed to the adversary enables impersonation through identity challenge questions
A one-time password shared with the adversary allows immediate unauthorized login to a single service
Urgency tactics used in the email subject line directly expose the victim's stored account passwords
Show answer
Answer: (A)
Identifying that opening the attachment executed malicious software connects the action to its impact. The scenario describes a credential-stealing program installed via a malicious file, which is one of the three core impacts of social engineering: malware that steals information from the victim's browser or records login credentials as they are typed.
Question 9
After falling for a phishing email, a victim clicks a link that loads a page visually identical to their email provider's login screen. The victim enters their username and password, but the page does nothing. Which impact has the adversary achieved?
The victim's login credentials were captured by a fake page designed to harvest them for the adversary
The victim's device was infected with malware that will encrypt files and demand a ransom payment
The victim's personal challenge-question answers were exposed through the fake page's registration form
The victim's one-time password was intercepted as it was transmitted to the real email provider's server
Show answer
Answer: (A)
Recognizing that the non-functional page is a credential-harvesting site explains the mechanism. The adversary created a convincing replica of a legitimate login page so that any credentials the victim typed were sent directly to the adversary rather than to the real email provider, giving the adversary full access to the victim's account.
Question 10
An adversary sends a social media message to a target asking for their pet's name, hometown, and high school mascot, framing it as a fun personality quiz. The target answers all three questions publicly. Six months later, the adversary successfully resets the target's email password without knowing the original password. Which chain of events best explains how the earlier disclosure enabled this outcome?
The quiz answers matched the email provider's challenge questions, letting the adversary verify the target's identity and reset the password
The quiz answers were used as a decryption key to extract the target's hashed password from the email provider's database
The quiz link installed a keylogger that recorded the target's email password when they next logged in six months later
The public quiz answers allowed the adversary to intercept a one-time password sent to the target's phone during a login attempt
Show answer
Answer: (A)
Tracing the connection between seemingly harmless personal details and their use in account recovery reveals the adversary's strategy. Pet names, hometowns, and school mascots are among the most common challenge questions websites use to verify identity before allowing a password reset, so collecting them through a disguised quiz gave the adversary everything needed to impersonate the target months later.
What's on the AP Cybersecurity Unit 1 practice test
The standard version takes about 27 minutes and follows the timing and directions of the AP exam, sized to one unit:
- 20 Multiple Choice Questions (27 minutes)
Questions are drawn from 892 multiple-choice questions written for Unit 1, Introduction to Security.
Review Unit 1 before you start
- 1.1 Understanding Social Engineering
- 1.2 Suspicious Website Logins
- 1.3 Best Practices for Public Networks
- 1.4 AI-Based Cybersecurity Attacks
- 1.5 Leveraging AI in Cyber Defense