AP Cybersecurity Unit 2 practice questions
Try 10 multiple-choice questions from Unit 2 here. Pick an answer to see why it's right or wrong, then take the timed test above for a full AP-style set.
Question 1
ID TIME SEV SENSOR / LOCATION SIGNATURE / DESCRIPTION 001 07:12:04 LOW Badge Reader - Main Lobby Authorized badge scan: EMP-0441 (J. Harmon) 002 07:12:09 HIGH Badge Reader - Main Lobby TAILGATE DETECTED: Door held open >4 sec after single badge event; no second badge scan recorded 003 07:34:51 MEDIUM CCTV - Server Rm Hallway Motion detected; no badge event within ±60 sec on Server Room door (Badge Reader SR-02) 004 08:05:17 LOW Badge Reader - SR-02 Authorized badge scan: EMP-0112 (T. Vasquez) 005 08:05:22 HIGH Badge Reader - SR-02 PIGGYBACKING ALERT: Visitor log shows unescorted individual entered behind EMP-0112; visitor badge not scanned 006 08:47:33 HIGH USB Monitor - WS-114 UNAUTHORIZED USB DEVICE: Unknown HID device (non-inventory serial) inserted at workstation WS-114, Floor 2 007 09:15:02 MEDIUM CCTV - Finance Office Individual observed positioning camera-equipped device toward monitor of EMP-0289 (P. Okafor) for 38 sec 008 10:02:44 LOW Facilities - Dumpster Pad Scheduled custodial pickup; no anomaly flagged 009 10:58:11 HIGH Electrical Panel - Rm B04 POWER DISRUPTION: Breaker 7 (Server Rm UPS feed) tripped manually; UPS failover engaged; duration 00:02:17 010 11:03:29 CRITICAL Badge Reader - SR-02 CARD CLONE SUSPECTED: Badge UID 9A:F3:22:DC presented while EMP-0112 (T. Vasquez) is logged into remote VPN from off-site IP 203.0.113.47; simultaneous access impossible 011 11:04:01 HIGH Server Room - Rack A Physical access logged; no work order on file for this time window 012 14:22:38 MEDIUM CCTV - Recycling Area Individual photographed contents of unsecured document bin near Printer Station 3 ========================================================================== NOTES: Alerts 002, 005, 010 flagged for Security Team immediate review. </>CodeAlert 009 correlated with Alert 011 — possible coordinated physical intrusion. Alert 007 may indicate shoulder surfing attempt; review CCTV footage retained 72 hr.==========================================================================
Based on the SIEM dashboard, what distinguishes the vulnerability exploited in Alert 005 from the one observed in Alert 002?
Alert 005 involves an authorized user knowingly allowing an unauthenticated individual entry, whereas Alert 002 involves an individual slipping in undetected.
Alert 005 relies on duplicating an authorized user's physical access token, whereas Alert 002 relies on exploiting a mechanical door failure.
Alert 005 indicates an adversary bypassing the badge reader using a cloned card, whereas Alert 002 indicates bypass using a stolen key.
Alert 005 demonstrates an attack targeting the server room's environmental controls, whereas Alert 002 targets the main lobby's perimeter security.
Show answer
Answer: (A)
The stimulus differentiates between two common physical access vulnerabilities: tailgating and piggybacking. Alert 002 describes tailgating (an attacker slipping through a door held open by a legitimate user). Alert 005 describes piggybacking, evidenced by the visitor log noting an unescorted individual entering behind an authorized user, which implies the authorized user was aware of the entry but failed to enforce security protocols.
Question 2
A hospital's network security team discovers that an attacker bypassed the perimeter firewall by exploiting a phishing email that tricked an employee into installing malware. Despite this breach, the attacker is unable to access patient records because file-level encryption and strict access controls are still blocking them. Which principle of defense-in-depth does this scenario best illustrate?
Resilience through layered controls limits damage when one security layer is bypassed by an adversary
Preventative controls at the network layer are sufficient to stop all adversaries from reaching sensitive data
Detective controls at the device layer identified the malware before it could reach any sensitive patient records
Risk transference to a cyber insurance policy reduced the financial impact of the attacker's network breach
Show answer
Answer: (A)
Recognizing that the data layer's encryption and access controls stopped the attacker even after the network perimeter was compromised demonstrates defense-in-depth resilience. When one control fails, subsequent layers—here at the data and application level—still prevent unauthorized access, which is the core justification for a layered security strategy.
Question 3
A retail company deploys only a network-layer firewall as its sole security control. An attacker who steals valid employee credentials walks past the firewall undetected and exfiltrates customer payment data. Which gap in the company's security strategy does this attack most directly expose?
Relying on a single control type leaves no additional layer to stop an attacker who bypasses that control
Failing to implement authentication controls allowed an attacker with valid credentials to access systems that should have required additional verification
Deploying only network-layer protection without data-layer controls like encryption meant the stolen credentials granted direct access to unprotected payment data
The firewall successfully prevented network-based attacks, but the company lacked endpoint detection to identify the credential theft before data exfiltration occurred
Show answer
Answer: (A)
This attack succeeded because the firewall was the only line of defense; once the attacker bypassed it using stolen credentials, no other control existed to detect or stop the exfiltration. This illustrates the core weakness of relying on a single control type rather than layering multiple, independent defenses.
Question 4
A university's security team is designing a new protection strategy after an audit revealed that a single compromised faculty account allowed an attacker to move laterally across the network and reach the student records database. The team wants to ensure that future lateral movement is detected and stopped before sensitive data is reached. Which combination of defense-in-depth layers would most directly address both detection and containment of lateral movement?
Network segmentation to contain lateral movement combined with an intrusion detection system to identify unusual account activity
Physical perimeter locks on server rooms combined with security cameras to monitor unauthorized physical entry attempts
A password policy requiring complexity combined with annual security awareness training for all faculty members
Cyber insurance transference policy combined with a documented incident response plan for post-breach recovery
Show answer
Answer: (A)
Applying both a network-layer control (segmentation limits how far an attacker can move between systems) and a detective control (an intrusion detection system flags anomalous behavior) directly addresses the two goals: containment and detection. This combination reflects defense-in-depth by using controls from different layers that complement each other against the specific threat of lateral movement.
Question 5
A small logistics company uses only anti-malware software on employee devices as its entire cybersecurity strategy. A security consultant argues this approach is insufficient. Which statement best explains why a defense-in-depth strategy is necessary compared to this single-control approach?
Different threats require different controls, and a single device-layer tool cannot address physical, network, or human-layer vulnerabilities
Anti-malware software is a corrective control, and organizations must use only preventative controls to stop attacks before they begin
Device-layer controls are the most expensive to maintain, so replacing them with network-layer firewalls would be more cost-effective
Anti-malware software violates the confidentiality principle because it scans file contents that employees expect to remain private
Show answer
Answer: (A)
Defense-in-depth is necessary because threats arrive through multiple vectors—social engineering targets people, physical intruders bypass digital tools, and network attacks may not trigger device-level anti-malware. A single device-layer control addresses only one category of threat, leaving the organization exposed to all others that require controls suited to their specific layer.
Question 6
An employee receives an email stating: 'All staff have already updated their login credentials through our new security portal. You are the only one who has not completed this step. Please click the link below to avoid being locked out.' Which social engineering tactic is the adversary primarily using?
Consensus, by implying every other employee has already complied with the request
Urgency, by implying the target must act immediately to avoid being locked out
Authority, by implying the request originates from someone with power over the target
Scarcity, by implying limited access to the security portal will soon be unavailable
Show answer
Answer: (A)
Recognizing that the message creates social pressure by claiming everyone else has already taken the desired action identifies this as consensus. The adversary exploits the target's desire to conform by framing non-compliance as an outlier behavior, which is the defining feature of the consensus tactic.
Question 7
A caller contacts a hospital receptionist, introduces herself as a nurse from a partner clinic, and says she needs a patient's contact information to coordinate follow-up care. The caller has researched the hospital's staff directory and uses the name of a real physician as a reference. Which social engineering tactic best describes the caller's initial setup for this attack?
Pretexting, by constructing a believable professional reason to justify the contact
Familiarity, by referencing a real physician the receptionist is likely to recognize
Authority, by impersonating a medical professional with power over patient records
Intimidation, by implying patient harm could result from withholding the information
Show answer
Answer: (A)
Identifying the caller's fabricated nurse identity and care-coordination story as a pretext is the key analytical step. Pretexting is when an adversary creates a believable reason to contact a target, and the caller's cover story—complete with a real physician's name—is designed to make the request seem legitimate before any psychological pressure is applied.
Question 8
A university student receives a text message that reads: 'This is the Financial Aid Office. Your scholarship disbursement of $3,200 will be permanently canceled in 45 minutes unless you verify your student ID and bank account number by replying to this message.' Which combination of social engineering tactics does this message use?
Authority and urgency, by impersonating an office with power and imposing a tight deadline
Intimidation and scarcity, by threatening cancellation and implying limited scholarship funds
Familiarity and consensus, by referencing a known campus office and peer behavior
Pretexting and consensus, by inventing a disbursement story and implying others verified already
Show answer
Answer: (A)
Connecting two simultaneous tactics requires recognizing that 'Financial Aid Office' invokes authority by impersonating an entity with power over the student's finances, while the 45-minute window creates urgency by imposing a deadline that demands immediate action. Together these tactics suppress the target's critical thinking and push toward compliance.
Question 9
A cybersecurity trainer asks trainees to identify the social engineering tactic in this scenario: an adversary sends an email offering exclusive early access to a company's new software tool, but states that only the first ten employees to register will receive a license. What tactic is the adversary using?
Scarcity, by limiting the offer to the first ten employees to create competitive pressure
Urgency, by pressuring employees to register before the deadline passes for the offer
Consensus, by implying that other employees are already signing up for the software tool
Familiarity, by framing the offer as an exclusive benefit reserved for trusted insiders
Show answer
Answer: (A)
Scarcity works by making a target believe that a resource or opportunity is in limited supply, prompting action before the target can think critically. Capping the offer at ten licenses directly creates this sense of limited availability, which is the defining feature of the scarcity tactic.
Question 10
An adversary calls a company's IT help desk, claims to be a senior vice president traveling abroad, and says, "Reset my password immediately. If this account is not restored in the next ten minutes, I will report this failure to the board, and you will be held personally responsible." Which social engineering tactics does this attack combine, and why is this combination especially effective?
Authority and intimidation use executive rank and personal threats to force compliance
Pretexting and urgency use a travel story and short deadline to pressure action
Familiarity and scarcity rely on a known executive role and a limited reset window
Consensus and urgency imply others comply and demand action within ten minutes
Show answer
Answer: (A)
The caller poses as a senior vice president, which uses authority to suppress skepticism. The threat of board reporting and personal blame adds intimidation, making verification feel risky and compliance feel safer.
What's on the AP Cybersecurity Unit 2 practice test
The standard version takes about 27 minutes and follows the timing and directions of the AP exam, sized to one unit:
- 20 Multiple Choice Questions (27 minutes)
Questions are drawn from 1096 multiple-choice questions written for Unit 2, Securing Spaces.
Review Unit 2 before you start
- 2.1 Cyber Foundations
- 2.2 Physical Vulnerabilities and Attacks
- 2.3 Protecting Physical Spaces
- 2.4 Detecting Physical Attacks