--- title: "AP Cybersecurity Unit 3 Practice Test" description: "A timed AP Cybersecurity Unit 3 (Securing Networks) practice test in the AP format, drawn from 833 multiple-choice questions written for the unit. The standard version takes about 27 minutes." canonical: "https://fiveable.me/ap-cybersecurity/unit-test/3" type: "unit-test" subject: "AP Cybersecurity" unit: "Unit 3" --- # AP Cybersecurity Unit 3 Practice Test ## Overview A timed AP Cybersecurity Unit 3 (Securing Networks) practice test in the AP format, drawn from 833 multiple-choice questions written for the unit. The standard version takes about 27 minutes. ## Test Format - 20 Multiple Choice Questions (27 minutes) ## Practice Questions ### Question 1 **ARP Table and Switch Log — Suspected ARP Poisoning Incident** > === ARP Cache Snapshot — Core Switch SW-01 === > $ arp -a > > Timestamp: 2024-11-14 09:17:43 > > IP Address MAC Address Interface Age(s) Type > --------------------------------------------------------------------------- > 192.168.10.1 aa:bb:cc:11:22:33 Gi0/1 12 DYNAMIC (Default Gateway) > 192.168.10.20 00:1A:2B:3C:4D:5E Gi0/4 45 DYNAMIC (Workstation: WKSTN-SALES) > 192.168.10.35 00:9F:7E:6D:5C:4B Gi0/7 60 DYNAMIC (Workstation: WKSTN-HR) > 192.168.10.50 de:ad:be:ef:00:01 Gi0/12 3 DYNAMIC (Workstation: WKSTN-ACCT) > 192.168.10.100 de:ad:be:ef:00:01 Gi0/12 3 DYNAMIC (Server: FILE-SRV-01) > > === Switch Port MAC Address Table — SW-01 === > $ show mac address-table > > Line VLAN MAC Address Type Port > ------------------------------------------------------- > 01 10 aa:bb:cc:11:22:33 STATIC Gi0/1 > 02 10 00:1A:2B:3C:4D:5E DYNAMIC Gi0/4 > 03 10 00:9F:7E:6D:5C:4B DYNAMIC Gi0/7 > 04 10 de:ad:be:ef:00:01 DYNAMIC Gi0/12 > > === Syslog — SW-01 Anomalous ARP Events === > > Line Timestamp Severity Message > ----------------------------------------------------------------------- > 01 2024-11-14 09:14:02 WARNING Gratuitous ARP received on Gi0/12: IP 192.168.10.50 → MAC de:ad:be:ef:00:01 > 02 2024-11-14 09:14:03 WARNING Gratuitous ARP received on Gi0/12: IP 192.168.10.100 → MAC de:ad:be:ef:00:01 > 03 2024-11-14 09:14:03 WARNING ARP reply rate exceeded threshold on Gi0/12 (87 replies/sec) > 04 2024-11-14 09:14:05 INFO ARP cache updated: 192.168.10.50 now maps to de:ad:be:ef:00:01 > 05 2024-11-14 09:14:05 INFO ARP cache updated: 192.168.10.100 now maps to de:ad:be:ef:00:01 > 06 2024-11-14 09:15:11 INFO Traffic destined for 192.168.10.100 (FILE-SRV-01) forwarded to Gi0/12 > 07 2024-11-14 09:15:12 INFO Traffic destined for 192.168.10.50 (WKSTN-ACCT) forwarded to Gi0/12 > 08 2024-11-14 09:16:30 INFO Outbound session observed: Gi0/12 → 203.0.113.47:443 (external) > 09 2024-11-14 09:17:01 WARNING Duplicate IP detected: 192.168.10.100 claimed by two MAC addresses > 10 2024-11-14 09:17:43 CRITICAL Dynamic ARP Inspection (DAI) not configured on VLAN 10 > > NOTE: Prior recorded MAC for 192.168.10.100 (FILE-SRV-01) was 00:FF:AA:BB:CC:12 (Gi0/9). > NOTE: Prior recorded MAC for 192.168.10.50 (WKSTN-ACCT) was 00:3E:1A:9C:77:D4 (Gi0/5). Based on the correlation of the ARP cache snapshot and the syslog events between 09:14:02 and 09:16:30, which of the following best classifies the adversary's primary objective? - (A) Establishing a man-in-the-middle position to intercept and exfiltrate data. - (B) Executing a denial-of-service attack against the network switch. - (C) Bypassing port security controls by cloning an authorized MAC address. - (D) Exploiting an operating system vulnerability on the internal file server. **Answer: (A)** The combination of gratuitous ARP messages, updated cache mappings redirecting traffic to a single port (Gi0/12), and a subsequent outbound external connection strongly indicates a Man-in-the-Middle attack designed for data exfiltration, rather than a DoS or endpoint OS exploit. ### Question 2 A university's security team is designing a new protection strategy after an audit revealed that a single compromised faculty account allowed an attacker to move laterally across the network and reach the student records database. The team wants to ensure that future lateral movement is detected and stopped before sensitive data is reached. Which combination of defense-in-depth layers would most directly address both detection and containment of lateral movement? - (A) Network segmentation to contain lateral movement combined with an intrusion detection system to identify unusual account activity - (B) Physical perimeter locks on server rooms combined with security cameras to monitor unauthorized physical entry attempts - (C) A password policy requiring complexity combined with annual security awareness training for all faculty members - (D) Cyber insurance transference policy combined with a documented incident response plan for post-breach recovery **Answer: (A)** Applying both a network-layer control (segmentation limits how far an attacker can move between systems) and a detective control (an intrusion detection system flags anomalous behavior) directly addresses the two goals: containment and detection. This combination reflects defense-in-depth by using controls from different layers that complement each other against the specific threat of lateral movement. ### Question 3 A healthcare organization deploys two threat detection systems. System A alerts whenever any login fails, while System B alerts only when more than 50 logins fail within two minutes from an unrecognized device. A password attack using an automated tool submits 200 guesses per minute against a nurse's account at 4:00 AM. Which evaluation of the two systems is most accurate? - (A) System B is more effective because it matches the attack’s high volume and unknown device - (B) System A is more effective because every failed login guarantees an attack is detected - (C) Both systems are equally effective because either one will eventually trigger an alert - (D) Neither system is effective because password attacks are only detected after a successful login **Answer: (A)** Effective detection depends on whether alert rules match the attack pattern. Automated password attacks create many rapid failures from an unfamiliar device, which System B is designed to flag. System A would also trigger on ordinary mistakes, creating too much noise to be as useful. ### Question 4 A hacktivist group opposes a multinational corporation's environmental practices. The group's members lack programming expertise but successfully disrupt the company's public website using a denial-of-service tool downloaded from an online forum. Which security control would best mitigate this specific threat, and why does the adversary's skill level matter for choosing it? - (A) Rate-limiting and traffic filtering controls, because low-skilled adversaries use known attack tools whose traffic patterns can be detected and blocked - (B) Zero-day patch management programs, because low-skilled adversaries specifically target undocumented software vulnerabilities in web servers - (C) Rate-limiting and traffic filtering controls, because high-skilled adversaries use novel tools that require adaptive filtering to detect - (D) Mandatory employee security awareness training, because low-skilled adversaries rely on social engineering rather than technical exploit tools **Answer: (A)** Identifying the group as low-skilled adversaries—they downloaded a pre-built tool rather than creating one—and connecting that classification to the appropriate control. Because low-skilled tools exploit known attack patterns, rate-limiting and traffic filtering can recognize and block the predictable traffic signatures those tools generate. ### Question 5 A cybersecurity team deploys an intrusion detection system (IDS) that compares incoming traffic against a database of known malware signatures. An attacker later breaches the network using a custom-built tool that exploits a vulnerability no vendor has yet documented. Which conclusion about the IDS's effectiveness against this adversary is best supported? - (A) The IDS will likely fail to detect the attack because high-skilled adversaries use novel tools that signature databases do not yet contain - (B) The IDS will likely detect the attack because high-skilled adversaries always reuse tools that signature databases already contain - (C) The IDS will likely fail to detect the attack because low-skilled adversaries use novel tools that signature databases do not yet contain - (D) The IDS will likely detect the attack because signature databases are updated in real time to include zero-day exploits **Answer: (A)** Evaluating signature-based detection against a high-skilled adversary reveals a fundamental gap: the IDS can only match traffic to known signatures, but a custom tool exploiting an undocumented zero-day has no existing signature to match. High-skilled adversaries are specifically defined by their ability to create tools that evade established defenses. ### Question 6 A nation-state group discovers a previously unknown flaw in widely used industrial control software and writes a custom exploit to target power grid operators. No patch exists because the vendor is unaware of the vulnerability. Which adversary classification fits this group, and which layered control is most relevant given that patching is not yet possible? - (A) A high-skilled adversary exploiting a zero day; network segmentation limits lateral movement until a patch is released - (B) A low-skilled adversary exploiting a known flaw; network segmentation limits lateral movement until a patch is released - (C) A high-skilled adversary exploiting a zero day; immediate patch deployment eliminates the vulnerability before damage occurs - (D) A high-skilled adversary exploiting a zero day; SSID verification training prevents employees from connecting to rogue networks **Answer: (A)** Discovering an undocumented vulnerability and writing a custom exploit are defining characteristics of a high-skilled adversary. Because no patch exists, patch management cannot help; network segmentation is a compensating control that restricts how far an attacker can move through the environment while the vendor develops a fix. ### Question 7 A hacktivist group opposed to a corporation's environmental practices launches an attack using a freely purchased denial-of-service toolkit that floods the company's public website with traffic, taking it offline. Which adversary type and layered defense combination is most appropriate? - (A) A low-skilled, cause-motivated adversary; rate-limiting and traffic filtering controls reduce the attack's effectiveness - (B) A high-skilled, cause-motivated adversary; rate-limiting and traffic filtering controls reduce the attack's effectiveness - (C) A low-skilled, greed-motivated adversary; rate-limiting and traffic filtering controls reduce the attack's effectiveness - (D) A low-skilled, cause-motivated adversary; patch management and software updates eliminate the denial-of-service vulnerability **Answer: (A)** Purchasing a ready-made toolkit that exploits known denial-of-service techniques places this group in the low-skilled category, while opposition to the corporation's practices reflects dedication to a cause as the motivation. Rate-limiting and traffic filtering are network-layer controls that reduce the volume of malicious traffic reaching the server, directly countering the attack method used. ### Question 8 During a post-incident review, a security team discovers that an attacker modified an existing Wi-Fi interception tool to evade the organization's newly deployed wireless intrusion detection system, then used the modified tool to capture traffic on the corporate guest network. How should the team classify this adversary, and what should the mitigation log emphasize? - (A) A high-skilled adversary who adapted existing tools to defeat new defenses, with the log emphasizing the specific evasion technique to update detection signatures - (B) A low-skilled adversary who used an unmodified purchased tool against known vulnerabilities, with the log emphasizing standard patch status to prevent recurrence - (C) A high-skilled adversary who adapted existing tools to defeat new defenses, with the log emphasizing standard patch status to prevent recurrence - (D) A low-skilled adversary who used an unmodified purchased tool against known vulnerabilities, with the log emphasizing the specific evasion technique to update detection signatures **Answer: (A)** Modifying an existing tool to adapt to new defensive techniques is a defining characteristic of a high-skilled adversary. The mitigation log should document the specific evasion method so that detection signatures and rules can be updated, preventing the same technique from succeeding in future incidents. ### Question 9 During a security assessment of a hospital campus, a technician discovers that an adversary has been broadcasting a powerful electromagnetic signal on the 2.4 GHz frequency band, completely preventing wireless communication between nurses' tablets and the access points. Which type of wireless attack is occurring, and which layered control best addresses it? - (A) A jamming attack; deploying wired network connections as a redundant backup for critical systems - (B) An evil twin attack; deploying wired network connections as a redundant backup for critical systems - (C) A jamming attack; enforcing HTTPS on all tablet applications to encrypt traffic in transit - (D) A war driving attack; deploying wired network connections as a redundant backup for critical systems **Answer: (A)** Identifying the electromagnetic signal flood as a jamming attack, which is a denial of service (DoS) attack that blocks wireless communication without stealing data. Because jamming physically disrupts the wireless medium, the most effective layered control is providing an alternative wired infrastructure so critical operations continue even when wireless access is unavailable. ### Question 10 A university security team discovers that students in a campus parking lot have been using freely available software to scan for and log every wireless network beacon detectable from outside the library building, identifying which networks use outdated WEP encryption. Which combination of controls best addresses both the reconnaissance technique being used and the vulnerability it revealed? - (A) Reduce the access point transmit power to limit beacon range, and upgrade all networks from WEP to WPA3 encryption - (B) Deploy a VPN requirement for all users, and upgrade all networks from WEP to WPA3 encryption - (C) Reduce the access point transmit power to limit beacon range, and require users to verify the SSID before connecting - (D) Install electromagnetic shielding on all windows, and upgrade all networks from WEP to WPA3 encryption **Answer: (A)** Identifying the parking-lot beacon scanning as war driving, which exploits signals that extend beyond the building and reveals encryption weaknesses. Reducing transmit power limits how far beacons travel, directly countering the reconnaissance. Upgrading from WEP to WPA3 addresses the specific vulnerability war driving exposed, creating a layered defense that both shrinks the attack surface and hardens the remaining network. ## Review the Unit - [3.1 Network Vulnerabilities and Attacks](/ap-cybersecurity/unit-3/network-vulnerabilities-and-attacks/study-guide/9lJpNM0eCHQ1M3XgFL97) - [3.2 Protecting Networks: Managerial Controls and Wireless Security](/ap-cybersecurity/unit-3/protecting-networks-managerial-controls-and-wireless-security/study-guide/aihx7DE7KUuSOsZ3dgwk) - [3.3 Protecting Networks: Segmentation](/ap-cybersecurity/unit-3/protecting-networks-segmentation/study-guide/aN5LZLgHojJwIT4AvjWS) - [3.4 Protecting Networks: Firewalls](/ap-cybersecurity/unit-3/protecting-networks-firewalls/study-guide/12y7V1SN54RlPrQELNJa) - [3.5 Detecting Network Attacks](/ap-cybersecurity/unit-3/detecting-network-attacks/study-guide/5kYH3dgJpqFp57SUnjEX) ## Other Unit Tests - [Unit 1: Introduction to Security](/ap-cybersecurity/unit-test/1) - [Unit 2: Securing Spaces](/ap-cybersecurity/unit-test/2) - [Unit 4: Securing Devices](/ap-cybersecurity/unit-test/4) - [Unit 5: Securing Applications and Data](/ap-cybersecurity/unit-test/5) ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)