AP Cybersecurity Unit 4 practice questions
Try 10 multiple-choice questions from Unit 4 here. Pick an answer to see why it's right or wrong, then take the timed test above for a full AP-style set.
Question 1
ID | Timestamp | Severity | Signature | Source IP | Dest IP | Details ------+---------------------+----------+------------------------------------+-----------------+----------------+------------------------------------------- 001 | 2024-11-12 08:14:03 | LOW | SCHEDULED_TASK_CREATED | 192.168.10.45 | — | Task: "UpdateHelper"; runs daily 03:00 002 | 2024-11-12 08:47:21 | MEDIUM | OUTBOUND_CONNECT_UNUSUAL_PORT | 192.168.10.45 | 203.0.113.88 | Port 4444/TCP; process: svcupdate.exe 003 | 2024-11-12 09:02:55 | HIGH | KEYLOGGER_BEHAVIOR_DETECTED | 192.168.10.45 | — | Process svcupdate.exe hooking keyboard API; log file written to C:\Users\jmorrow\AppData\Roaming\kl_out.dat 004 | 2024-11-12 09:03:01 | HIGH | SENSITIVE_FILE_EXFIL_ATTEMPT | 192.168.10.45 | 203.0.113.88 | kl_out.dat uploaded via HTTP POST; 14 KB 005 | 2024-11-12 09:45:10 | MEDIUM | REGISTRY_PERSISTENCE_KEY_ADDED | 192.168.10.45 | — | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → svcupdate.exe 006 | 2024-11-12 10:11:33 | CRITICAL | RANSOMWARE_FILE_ENCRYPTION_STARTED | 192.168.10.45 | — | 47 files renamed with .LOCKED extension in C:\Users\jmorrow\Documents
007 | 2024-11-12 10:11:45 | CRITICAL | RANSOM_NOTE_DROPPED | 192.168.10.45 | — | File: README_DECRYPT.txt; text: "Your files are encrypted. Send 1.5 BTC to wallet 1Fz9...within 72 hours." 008 | 2024-11-12 10:12:00 | HIGH | SHADOW_COPY_DELETION_ATTEMPT | 192.168.10.45 | — | cmd.exe executed: vssadmin delete shadows /all /quiet 009 | 2024-11-12 11:30:47 | MEDIUM | LATERAL_MOVEMENT_SMB_SCAN | 192.168.10.45 | 192.168.10.0/24| SMB probe to 254 hosts; process: svcupdate.exe 010 | 2024-11-12 14:22:09 | LOW | ANTIVIRUS_DISABLED | 192.168.10.45 | — | Real-time protection turned off via PowerShell; user context: jmorrow
SUMMARY: 10 alerts | 2 CRITICAL | 4 HIGH | 3 MEDIUM | 1 LOW Recommended Action: ISOLATE WS-FINANCE-14 immediately; preserve memory image
Based on the chronological progression of alerts 003 through 008, which of the following best classifies the adversary's overarching attack methodology?
A double-extortion ransomware campaign combining data theft with system encryption.
A destructive wiper attack designed to permanently erase shadow copies and system files.
A botnet infection utilizing the host primarily for distributed denial-of-service attacks.
An insider threat operation leveraging authorized access to modify registry persistence keys.
Show answer
Answer: (A)
The sequence of alerts demonstrates a multi-stage attack where the adversary first steals sensitive data (Alerts 003 and 004) and then encrypts the local files while demanding payment (Alerts 006 and 007). Classifying this requires synthesizing the exfiltration and encryption phases, which together define a double-extortion ransomware methodology.
Question 2
An adversary installs software on a target laptop that silently records every key the user presses and periodically transmits that data to a remote server. The adversary's primary goal is to collect the user's banking credentials. Which type of malware best describes this tool?
A keylogger that captures credentials by recording all user keystrokes
A worm that captures credentials by spreading across connected network devices
Spyware that captures credentials by tracking and reporting all user activity
A trojan that captures credentials by disguising itself as legitimate software
Show answer
Answer: (A)
Identifying the defining behavior—recording keystrokes and sending them to an adversary—points directly to a keylogger. Keyloggers are specifically designed to capture credential data such as usernames and passwords by logging every key pressed, which matches the scenario exactly.
Question 3
A hospital network administrator discovers that all patient record files on a server have been encrypted and are inaccessible. A message on the screen demands payment within 72 hours in exchange for a decryption key. Which type of malware did the adversary most likely deploy to achieve this outcome?
Ransomware, which encrypts files and demands payment for a decryption key
A logic bomb, which encrypts files and demands payment after a timed trigger fires
A rootkit, which encrypts files and demands payment while hiding inside the OS
A trojan, which encrypts files and demands payment after posing as safe software
Show answer
Answer: (A)
Recognizing the combination of file encryption, loss of access, and a timed payment demand identifies this as ransomware. Ransomware specifically encrypts a device's files and presents the victim with a demand for payment in exchange for the decryption key, matching every element of the scenario.
Question 4
A security analyst investigating a corporate network breach finds no malicious files on any disk during a forensic scan. However, logs show that PowerShell, a legitimate administrative tool already installed on the compromised workstations, was used to execute unauthorized commands and exfiltrate data. The malicious code disappears after each reboot. Which type of malware best explains these findings?
Fileless malware, which runs in RAM and hijacks legitimate installed programs to attack
A rootkit, which runs in RAM and hijacks legitimate installed programs to hide itself
Spyware, which runs in RAM and hijacks legitimate installed programs to track activity
A worm, which runs in RAM and hijacks legitimate installed programs to self-replicate
Show answer
Answer: (A)
Connecting the absence of disk-based files, the use of a legitimate installed program (PowerShell), and the disappearance of the code after reboot identifies this as fileless malware. Fileless malware lives in RAM and uses legitimate programs already on the device, leaving no file for traditional antivirus to detect.
Question 5
An adversary embeds malicious code inside a free video editing application available for download online. Once a user installs the application, the adversary gains the ability to remotely issue commands to the user's computer, browse its file system, and activate its webcam. Which type of malware was used in this attack?
A remote access trojan (RAT), hidden inside seemingly harmless software to enable remote control
A virus, hidden inside seemingly harmless software to enable remote control after user activation
A worm, hidden inside seemingly harmless software to enable remote control through self-replication
Spyware, hidden inside seemingly harmless software to enable remote control and activity tracking
Show answer
Answer: (A)
Identifying malware hidden inside legitimate-looking software that grants the adversary remote control of the target system points to a remote access trojan (RAT). RATs are a specific category of trojan that provide the adversary with remote access to the compromised system, including the ability to browse files and control hardware like webcams.
Question 6
A disgruntled network administrator, before resigning from a company, inserts code into the payroll system that will delete all employee salary records on the first day of the next fiscal year. The code remains completely dormant until that specific date arrives. Which type of malware did the administrator deploy?
A logic bomb, which stays dormant and triggers its payload only when set conditions are met
Ransomware, which stays dormant and triggers file encryption only when set conditions are met
A rootkit, which stays dormant and triggers system takeover only when set conditions are met
A worm, which stays dormant and triggers self-replication across the network on a set date
Show answer
Answer: (A)
Recognizing that the malicious code remains inactive until a specific date condition is satisfied identifies this as a logic bomb. Logic bombs are defined by their conditional trigger: they execute their payload only when a specific set of conditions—such as a date, OS version, or other parameter—are met, exactly as described in the scenario.
Question 7
A hospital's security team wants to monitor for unauthorized access attempts across all device types on its network. Which device type would pose the greatest challenge to standard system monitoring because it uses specialized instruction sets and has minimal storage for logging software?
An embedded computer controlling an IV pump in the intensive care unit
A laptop used by a nurse for electronic health record access and documentation
A server providing DNS and DHCP services to all devices on the hospital network
A smartphone used by physicians to receive patient alert notifications and messages
Show answer
Answer: (A)
Recognizing embedded computers as a distinct category with hardware constraints that limit monitoring reveals why they are uniquely difficult to secure. Embedded devices run specialized instruction sets for their specific machine components and have minimal storage, making it impractical to install logging agents or monitoring software directly on the device.
Question 8
A network administrator sets up traffic monitoring on a water treatment plant's control network and detects repeated unauthorized connection attempts targeting port 502, which is used by the plant's pump controllers. What type of computing device are these pump controllers, and why does their device category make attack detection especially critical?
They are embedded computers controlling critical infrastructure, so a successful attack could disrupt essential public services
They are personal computers managing plant operations, so a successful attack would only affect individual user productivity
They are server computers providing data services, so a successful attack would only expose stored operational records
They are handheld computers used by technicians, so a successful attack would only compromise mobile communication data
Show answer
Answer: (A)
Identifying pump controllers as embedded computers within the IoT category for critical infrastructure connects device type to risk level. Embedded computers in water treatment plants control physical processes that affect public safety, meaning a successful attack could manipulate pumps to disrupt or contaminate water supplies, making continuous monitoring of these devices essential.
Question 9
A security analyst reviewing endpoint logs notices that a smartwatch on the corporate network sent a burst of data to an external IP address at 3 a.m. Compared to monitoring a desktop workstation for the same behavior, what challenge does the smartwatch's device category create for the analyst?
Handheld computers like smartwatches run on battery power and have limited storage, restricting the depth of local logs available for forensic review
Handheld computers like smartwatches have more processing power than servers, making log analysis slower and more resource-intensive for analysts
Handheld computers like smartwatches provide services to other network devices, so their logs contain data from many users rather than one individual
Handheld computers like smartwatches use specialized instruction sets for physical machinery, preventing standard network monitoring tools from reading their traffic
Show answer
Answer: (A)
Applying knowledge of handheld computer characteristics to a monitoring scenario reveals a practical detection challenge. Smartwatches are handheld computers that run on battery power and have less storage than desktop personal computers, meaning they generate shallower local logs and may not retain detailed forensic data that an analyst needs to reconstruct the full scope of the suspicious transfer.
Question 10
A hospital's embedded insulin pump controllers have not received a firmware update in two years, and a known critical vulnerability in their software was publicly disclosed six months ago. Which combination of layered security controls would most directly address this situation?
Apply the firmware patch immediately and segment the devices on an isolated network to limit exploit reach
Install anti-malware software on the pumps and require users to change their passwords every 90 days
Enable a firewall on the hospital's perimeter router and disable autorun on all connected USB drives
Add a BIOS password to each pump controller and configure open ports to require multi-factor authentication
Show answer
Answer: (A)
Patching removes the known vulnerability that adversaries can exploit, while network segmentation limits an attacker's ability to pivot to other systems if a device is compromised. Together these controls address both the root cause and the blast radius of a successful exploit on critical medical devices.
What's on the AP Cybersecurity Unit 4 practice test
The standard version takes about 77 minutes and follows the timing and directions of the AP exam, sized to one unit:
- 20 Multiple Choice Questions (27 minutes)
- 1 FRQ – Device Security Analysis (50 minutes)
Questions are drawn from 393 multiple-choice questions and 13 FRQs written for Unit 4, Securing Devices.
Practice AP Cybersecurity Unit 4 FRQs
Answer the unit's free-response questions one at a time and get a score on every part.
- Device Security Analysis (13 questions)
Review Unit 4 before you start
- 4.1 Device Vulnerabilities and Attacks
- 4.2 Authentication
- 4.3 Protecting Devices
- 4.4 Detecting Attacks on Devices