--- title: "AP Cybersecurity Unit 2 Practice Test" description: "A timed AP Cybersecurity Unit 2 (Securing Spaces) practice test in the AP format, drawn from 1,096 multiple-choice questions written for the unit. The standard version takes about 27 minutes." canonical: "https://fiveable.me/ap-cybersecurity/unit-test/2" type: "unit-test" subject: "AP Cybersecurity" unit: "Unit 2" --- # AP Cybersecurity Unit 2 Practice Test ## Overview A timed AP Cybersecurity Unit 2 (Securing Spaces) practice test in the AP format, drawn from 1,096 multiple-choice questions written for the unit. The standard version takes about 27 minutes. ## Test Format - 20 Multiple Choice Questions (27 minutes) ## Practice Questions ### Question 1 **SIEM Physical Security Incident Alerts — Meridian Financial Campus** > ========================================================================== > SIEM ALERT DASHBOARD | Meridian Financial Campus | 2024-11-14 > ========================================================================== > ID | TIME | SEV | SENSOR / LOCATION | SIGNATURE / DESCRIPTION > ------|------------|--------|----------------------------|--------------------------- > 001 | 07:12:04 | LOW | Badge Reader - Main Lobby | Authorized badge scan: EMP-0441 (J. Harmon) > 002 | 07:12:09 | HIGH | Badge Reader - Main Lobby | TAILGATE DETECTED: Door held open >4 sec after single badge event; no second badge scan recorded > 003 | 07:34:51 | MEDIUM | CCTV - Server Rm Hallway | Motion detected; no badge event within ±60 sec on Server Room door (Badge Reader SR-02) > 004 | 08:05:17 | LOW | Badge Reader - SR-02 | Authorized badge scan: EMP-0112 (T. Vasquez) > 005 | 08:05:22 | HIGH | Badge Reader - SR-02 | PIGGYBACKING ALERT: Visitor log shows unescorted individual entered behind EMP-0112; visitor badge not scanned > 006 | 08:47:33 | HIGH | USB Monitor - WS-114 | UNAUTHORIZED USB DEVICE: Unknown HID device (non-inventory serial) inserted at workstation WS-114, Floor 2 > 007 | 09:15:02 | MEDIUM | CCTV - Finance Office | Individual observed positioning camera-equipped device toward monitor of EMP-0289 (P. Okafor) for 38 sec > 008 | 10:02:44 | LOW | Facilities - Dumpster Pad | Scheduled custodial pickup; no anomaly flagged > 009 | 10:58:11 | HIGH | Electrical Panel - Rm B04 | POWER DISRUPTION: Breaker 7 (Server Rm UPS feed) tripped manually; UPS failover engaged; duration 00:02:17 > 010 | 11:03:29 | CRITICAL| Badge Reader - SR-02 | CARD CLONE SUSPECTED: Badge UID 9A:F3:22:DC presented while EMP-0112 (T. Vasquez) is logged into remote VPN from off-site IP 203.0.113.47; simultaneous access impossible > 011 | 11:04:01 | HIGH | Server Room - Rack A | Physical access logged; no work order on file for this time window > 012 | 14:22:38 | MEDIUM | CCTV - Recycling Area | Individual photographed contents of unsecured document bin near Printer Station 3 > ========================================================================== > NOTES: Alerts 002, 005, 010 flagged for Security Team immediate review. > Alert 009 correlated with Alert 011 — possible coordinated physical intrusion. > Alert 007 may indicate shoulder surfing attempt; review CCTV footage retained 72 hr. > ========================================================================== Based on the SIEM dashboard, what distinguishes the vulnerability exploited in Alert 005 from the one observed in Alert 002? - (A) Alert 005 involves an authorized user knowingly allowing an unauthenticated individual entry, whereas Alert 002 involves an individual slipping in undetected. - (B) Alert 005 relies on duplicating an authorized user's physical access token, whereas Alert 002 relies on exploiting a mechanical door failure. - (C) Alert 005 indicates an adversary bypassing the badge reader using a cloned card, whereas Alert 002 indicates bypass using a stolen key. - (D) Alert 005 demonstrates an attack targeting the server room's environmental controls, whereas Alert 002 targets the main lobby's perimeter security. **Answer: (A)** The stimulus differentiates between two common physical access vulnerabilities: tailgating and piggybacking. Alert 002 describes tailgating (an attacker slipping through a door held open by a legitimate user). Alert 005 describes piggybacking, evidenced by the visitor log noting an unescorted individual entering behind an authorized user, which implies the authorized user was aware of the entry but failed to enforce security protocols. ### Question 2 A hospital's network security team discovers that an attacker bypassed the perimeter firewall by exploiting a phishing email that tricked an employee into installing malware. Despite this breach, the attacker is unable to access patient records because file-level encryption and strict access controls are still blocking them. Which principle of defense-in-depth does this scenario best illustrate? - (A) Resilience through layered controls limits damage when one security layer is bypassed by an adversary - (B) Preventative controls at the network layer are sufficient to stop all adversaries from reaching sensitive data - (C) Detective controls at the device layer identified the malware before it could reach any sensitive patient records - (D) Risk transference to a cyber insurance policy reduced the financial impact of the attacker's network breach **Answer: (A)** Recognizing that the data layer's encryption and access controls stopped the attacker even after the network perimeter was compromised demonstrates defense-in-depth resilience. When one control fails, subsequent layers—here at the data and application level—still prevent unauthorized access, which is the core justification for a layered security strategy. ### Question 3 A retail company deploys only a network-layer firewall as its sole security control. An attacker who steals valid employee credentials walks past the firewall undetected and exfiltrates customer payment data. Which gap in the company's security strategy does this attack most directly expose? - (A) Relying on a single control type leaves no additional layer to stop an attacker who bypasses that control - (B) Failing to implement authentication controls allowed an attacker with valid credentials to access systems that should have required additional verification - (C) Deploying only network-layer protection without data-layer controls like encryption meant the stolen credentials granted direct access to unprotected payment data - (D) The firewall successfully prevented network-based attacks, but the company lacked endpoint detection to identify the credential theft before data exfiltration occurred **Answer: (A)** This attack succeeded because the firewall was the only line of defense; once the attacker bypassed it using stolen credentials, no other control existed to detect or stop the exfiltration. This illustrates the core weakness of relying on a single control type rather than layering multiple, independent defenses. ### Question 4 A small logistics company uses only anti-malware software on employee devices as its entire cybersecurity strategy. A security consultant argues this approach is insufficient. Which statement best explains why a defense-in-depth strategy is necessary compared to this single-control approach? - (A) Different threats require different controls, and a single device-layer tool cannot address physical, network, or human-layer vulnerabilities - (B) Anti-malware software is a corrective control, and organizations must use only preventative controls to stop attacks before they begin - (C) Device-layer controls are the most expensive to maintain, so replacing them with network-layer firewalls would be more cost-effective - (D) Anti-malware software violates the confidentiality principle because it scans file contents that employees expect to remain private **Answer: (A)** Defense-in-depth is necessary because threats arrive through multiple vectors—social engineering targets people, physical intruders bypass digital tools, and network attacks may not trigger device-level anti-malware. A single device-layer control addresses only one category of threat, leaving the organization exposed to all others that require controls suited to their specific layer. ### Question 5 A disgruntled former contractor, motivated by revenge, uses a war driving technique to map the wireless signal coverage of their former employer's office building from the parking lot. The contractor then attempts to connect to the corporate network from outside the building. Which adversary classification and set of layered controls best addresses both the reconnaissance phase and the subsequent connection attempt? - (A) A low-to-medium-skilled adversary; reducing signal leakage through directional antennas and requiring VPN authentication for remote access - (B) A high-skilled adversary; reducing signal leakage through directional antennas and requiring VPN authentication for remote access - (C) A low-to-medium-skilled adversary; implementing network segmentation and requiring VPN authentication for remote access - (D) A low-to-medium-skilled adversary; reducing signal leakage through directional antennas and requiring multi-factor authentication for network access **Answer: (A)** War driving requires no custom tool development and targets information gathered passively, consistent with a lower-skilled adversary motivated by revenge. Directional antennas reduce the physical reach of the wireless signal to limit reconnaissance success, while mandatory VPN authentication adds an access-control layer that blocks unauthorized connection attempts even if the signal is detected. ### Question 6 During a security audit of a hospital campus, a technician discovers that the hospital's Wi-Fi signal is detectable from the parking garage two blocks away. An adversary who exploited this finding by scanning the area on foot to map the signal's reach would be conducting which type of wireless attack, and what is the primary security risk this reconnaissance creates? - (A) War driving; the adversary identifies attack targets and signal boundaries for a later intrusion attempt - (B) Evil twin; the adversary identifies attack targets and signal boundaries for a later intrusion attempt - (C) War driving; the adversary immediately captures patient data transmitted over the detected network - (D) Jamming; the adversary identifies attack targets and signal boundaries for a later intrusion attempt **Answer: (A)** Scanning for wireless network beacons while moving through an area to gather information about network type and signal reach is the definition of war driving from EK 1.3.B.3. The primary risk is that the adversary now knows the network exists, its characteristics, and that it can be reached from outside the building, enabling a future attack without requiring physical entry. ### Question 7 A university's wireless security team deploys a system that continuously scans for unexpected access points, logs all detected SSIDs, and alerts when electromagnetic interference spikes on the 5 GHz band. During a campus event, the system simultaneously triggers an interference alert and detects a new access point with an SSID nearly identical to the university's guest network. Which combination of attacks is the monitoring system most likely detecting? - (A) A jamming attack disrupting the legitimate network alongside an evil twin attack redirecting users to a rogue access point - (B) A war driving attack mapping the campus network alongside an evil twin attack redirecting users to a rogue access point - (C) A jamming attack disrupting the legitimate network alongside a war driving attack mapping the campus signal coverage - (D) A jamming attack disrupting the legitimate network alongside a second jamming attack on a different frequency band **Answer: (A)** Recognizing that the two simultaneous alerts correspond to two distinct wireless attacks used together. The electromagnetic interference spike on the wireless frequency band is the signature of a jamming attack, which knocks users off the legitimate network as a denial of service. The near-identical SSID from an unexpected access point is the signature of an evil twin attack, positioned to capture traffic from users who reconnect to what appears to be the university's guest network. ### Question 8 During a security audit of a hospital campus, an IT team discovers that the facility's Wi-Fi signal extends 200 feet into the public parking lot. An adversary has been parking nearby and recording the network names and encryption types broadcast by the hospital's access points. Which wireless attack is the adversary conducting, and what mitigation should the team log as implemented? - (A) War driving, mitigated by reducing transmit power on access points to limit signal leakage beyond the building perimeter - (B) Evil twin, mitigated by instructing staff to verify the exact SSID name before connecting to any wireless network on campus - (C) Jamming, mitigated by deploying frequency-monitoring sensors to detect and alert on abnormal electromagnetic signal levels - (D) Denial of service, mitigated by configuring the access points to reject repeated unauthenticated connection requests from unknown devices **Answer: (A)** Identifying that an adversary detecting and recording wireless network beacons while moving through or stationary near a target area is the definition of war driving. The appropriate mitigation is reducing the wireless signal's reach so it no longer extends into publicly accessible areas like the parking lot, which the team should log as a transmit-power adjustment on the affected access points. ### Question 9 An employee receives an email stating: 'All staff have already updated their login credentials through our new security portal. You are the only one who has not completed this step. Please click the link below to avoid being locked out.' Which social engineering tactic is the adversary primarily using? - (A) Consensus, by implying every other employee has already complied with the request - (B) Urgency, by implying the target must act immediately to avoid being locked out - (C) Authority, by implying the request originates from someone with power over the target - (D) Scarcity, by implying limited access to the security portal will soon be unavailable **Answer: (A)** Recognizing that the message creates social pressure by claiming everyone else has already taken the desired action identifies this as consensus. The adversary exploits the target's desire to conform by framing non-compliance as an outlier behavior, which is the defining feature of the consensus tactic. ### Question 10 A caller contacts a hospital receptionist, introduces herself as a nurse from a partner clinic, and says she needs a patient's contact information to coordinate follow-up care. The caller has researched the hospital's staff directory and uses the name of a real physician as a reference. Which social engineering tactic best describes the caller's initial setup for this attack? - (A) Pretexting, by constructing a believable professional reason to justify the contact - (B) Familiarity, by referencing a real physician the receptionist is likely to recognize - (C) Authority, by impersonating a medical professional with power over patient records - (D) Intimidation, by implying patient harm could result from withholding the information **Answer: (A)** Identifying the caller's fabricated nurse identity and care-coordination story as a pretext is the key analytical step. Pretexting is when an adversary creates a believable reason to contact a target, and the caller's cover story—complete with a real physician's name—is designed to make the request seem legitimate before any psychological pressure is applied. ## Review the Unit - [2.1 Cyber Foundations](/ap-cybersecurity/unit-2/cyber-foundations/study-guide/0oS8jJyX7iolYntwz5Eh) - [2.2 Physical Vulnerabilities and Attacks](/ap-cybersecurity/unit-2/physical-vulnerabilities-and-attacks/study-guide/ZcvQYEyowkyIYrjESpUp) - [2.3 Protecting Physical Spaces](/ap-cybersecurity/unit-2/protecting-physical-spaces/study-guide/PhHFFwPlXGtEWL781jEc) - [2.4 Detecting Physical Attacks](/ap-cybersecurity/unit-2/detecting-physical-attacks/study-guide/Kb72LoynxAj68H4P71eN) ## Other Unit Tests - [Unit 1: Introduction to Security](/ap-cybersecurity/unit-test/1) - [Unit 3: Securing Networks](/ap-cybersecurity/unit-test/3) - [Unit 4: Securing Devices](/ap-cybersecurity/unit-test/4) - [Unit 5: Securing Applications and Data](/ap-cybersecurity/unit-test/5) ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)