--- title: "AP Cybersecurity Unit 4 Practice Test" description: "A timed AP Cybersecurity Unit 4 (Securing Devices) practice test in the AP format, drawn from 393 multiple-choice questions and 12 FRQs written for the unit. The standard version takes about 77 minutes." canonical: "https://fiveable.me/ap-cybersecurity/unit-test/4" type: "unit-test" subject: "AP Cybersecurity" unit: "Unit 4" --- # AP Cybersecurity Unit 4 Practice Test ## Overview A timed AP Cybersecurity Unit 4 (Securing Devices) practice test in the AP format, drawn from 393 multiple-choice questions and 12 FRQs written for the unit. The standard version takes about 77 minutes. ## Test Format - 20 Multiple Choice Questions (27 minutes) - 1 FRQ – Device Security Analysis (50 minutes) ## Unit FRQs by Type - [Device Security Analysis](/ap-cybersecurity/frq-practice?type=device-security-analysis&id=6a3d600f9c0b7d2d393298af): 12 questions ## Practice Questions ### Question 1 **SIEM Alert Dashboard — Endpoint Threat Detection Log** > ======================================================================= > SIEM ALERT DASHBOARD | Sensor: EDR-AGENT-07 | Host: WS-FINANCE-14 > Date Range: 2024-11-12 08:00 – 2024-11-12 14:30 | Exported by: soc_analyst > ======================================================================= > > ID | Timestamp | Severity | Signature | Source IP | Dest IP | Details > ------+---------------------+----------+------------------------------------+-----------------+----------------+------------------------------------------- > 001 | 2024-11-12 08:14:03 | LOW | SCHEDULED_TASK_CREATED | 192.168.10.45 | — | Task: "UpdateHelper"; runs daily 03:00 > 002 | 2024-11-12 08:47:21 | MEDIUM | OUTBOUND_CONNECT_UNUSUAL_PORT | 192.168.10.45 | 203.0.113.88 | Port 4444/TCP; process: svcupdate.exe > 003 | 2024-11-12 09:02:55 | HIGH | KEYLOGGER_BEHAVIOR_DETECTED | 192.168.10.45 | — | Process svcupdate.exe hooking keyboard API; log file written to C:\Users\jmorrow\AppData\Roaming\kl_out.dat > 004 | 2024-11-12 09:03:01 | HIGH | SENSITIVE_FILE_EXFIL_ATTEMPT | 192.168.10.45 | 203.0.113.88 | kl_out.dat uploaded via HTTP POST; 14 KB > 005 | 2024-11-12 09:45:10 | MEDIUM | REGISTRY_PERSISTENCE_KEY_ADDED | 192.168.10.45 | — | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → svcupdate.exe > 006 | 2024-11-12 10:11:33 | CRITICAL | RANSOMWARE_FILE_ENCRYPTION_STARTED | 192.168.10.45 | — | 47 files renamed with .LOCKED extension in C:\Users\jmorrow\Documents\ > 007 | 2024-11-12 10:11:45 | CRITICAL | RANSOM_NOTE_DROPPED | 192.168.10.45 | — | File: README_DECRYPT.txt; text: "Your files are encrypted. Send 1.5 BTC to wallet 1Fz9...within 72 hours." > 008 | 2024-11-12 10:12:00 | HIGH | SHADOW_COPY_DELETION_ATTEMPT | 192.168.10.45 | — | cmd.exe executed: vssadmin delete shadows /all /quiet > 009 | 2024-11-12 11:30:47 | MEDIUM | LATERAL_MOVEMENT_SMB_SCAN | 192.168.10.45 | 192.168.10.0/24| SMB probe to 254 hosts; process: svcupdate.exe > 010 | 2024-11-12 14:22:09 | LOW | ANTIVIRUS_DISABLED | 192.168.10.45 | — | Real-time protection turned off via PowerShell; user context: jmorrow > > ----------------------------------------------------------------------- > SUMMARY: 10 alerts | 2 CRITICAL | 4 HIGH | 3 MEDIUM | 1 LOW > Recommended Action: ISOLATE WS-FINANCE-14 immediately; preserve memory image > ======================================================================= Based on the chronological progression of alerts 003 through 008, which of the following best classifies the adversary's overarching attack methodology? - (A) A double-extortion ransomware campaign combining data theft with system encryption. - (B) A destructive wiper attack designed to permanently erase shadow copies and system files. - (C) A botnet infection utilizing the host primarily for distributed denial-of-service attacks. - (D) An insider threat operation leveraging authorized access to modify registry persistence keys. **Answer: (A)** The sequence of alerts demonstrates a multi-stage attack where the adversary first steals sensitive data (Alerts 003 and 004) and then encrypts the local files while demanding payment (Alerts 006 and 007). Classifying this requires synthesizing the exfiltration and encryption phases, which together define a double-extortion ransomware methodology. ### Question 2 An adversary installs software on a target laptop that silently records every key the user presses and periodically transmits that data to a remote server. The adversary's primary goal is to collect the user's banking credentials. Which type of malware best describes this tool? - (A) A keylogger that captures credentials by recording all user keystrokes - (B) A worm that captures credentials by spreading across connected network devices - (C) Spyware that captures credentials by tracking and reporting all user activity - (D) A trojan that captures credentials by disguising itself as legitimate software **Answer: (A)** Identifying the defining behavior—recording keystrokes and sending them to an adversary—points directly to a keylogger. Keyloggers are specifically designed to capture credential data such as usernames and passwords by logging every key pressed, which matches the scenario exactly. ### Question 3 A hospital network administrator discovers that all patient record files on a server have been encrypted and are inaccessible. A message on the screen demands payment within 72 hours in exchange for a decryption key. Which type of malware did the adversary most likely deploy to achieve this outcome? - (A) Ransomware, which encrypts files and demands payment for a decryption key - (B) A logic bomb, which encrypts files and demands payment after a timed trigger fires - (C) A rootkit, which encrypts files and demands payment while hiding inside the OS - (D) A trojan, which encrypts files and demands payment after posing as safe software **Answer: (A)** Recognizing the combination of file encryption, loss of access, and a timed payment demand identifies this as ransomware. Ransomware specifically encrypts a device's files and presents the victim with a demand for payment in exchange for the decryption key, matching every element of the scenario. ### Question 4 A security analyst investigating a corporate network breach finds no malicious files on any disk during a forensic scan. However, logs show that PowerShell, a legitimate administrative tool already installed on the compromised workstations, was used to execute unauthorized commands and exfiltrate data. The malicious code disappears after each reboot. Which type of malware best explains these findings? - (A) Fileless malware, which runs in RAM and hijacks legitimate installed programs to attack - (B) A rootkit, which runs in RAM and hijacks legitimate installed programs to hide itself - (C) Spyware, which runs in RAM and hijacks legitimate installed programs to track activity - (D) A worm, which runs in RAM and hijacks legitimate installed programs to self-replicate **Answer: (A)** Connecting the absence of disk-based files, the use of a legitimate installed program (PowerShell), and the disappearance of the code after reboot identifies this as fileless malware. Fileless malware lives in RAM and uses legitimate programs already on the device, leaving no file for traditional antivirus to detect. ### Question 5 An adversary embeds malicious code inside a free video editing application available for download online. Once a user installs the application, the adversary gains the ability to remotely issue commands to the user's computer, browse its file system, and activate its webcam. Which type of malware was used in this attack? - (A) A remote access trojan (RAT), hidden inside seemingly harmless software to enable remote control - (B) A virus, hidden inside seemingly harmless software to enable remote control after user activation - (C) A worm, hidden inside seemingly harmless software to enable remote control through self-replication - (D) Spyware, hidden inside seemingly harmless software to enable remote control and activity tracking **Answer: (A)** Identifying malware hidden inside legitimate-looking software that grants the adversary remote control of the target system points to a remote access trojan (RAT). RATs are a specific category of trojan that provide the adversary with remote access to the compromised system, including the ability to browse files and control hardware like webcams. ### Question 6 A disgruntled network administrator, before resigning from a company, inserts code into the payroll system that will delete all employee salary records on the first day of the next fiscal year. The code remains completely dormant until that specific date arrives. Which type of malware did the administrator deploy? - (A) A logic bomb, which stays dormant and triggers its payload only when set conditions are met - (B) Ransomware, which stays dormant and triggers file encryption only when set conditions are met - (C) A rootkit, which stays dormant and triggers system takeover only when set conditions are met - (D) A worm, which stays dormant and triggers self-replication across the network on a set date **Answer: (A)** Recognizing that the malicious code remains inactive until a specific date condition is satisfied identifies this as a logic bomb. Logic bombs are defined by their conditional trigger: they execute their payload only when a specific set of conditions—such as a date, OS version, or other parameter—are met, exactly as described in the scenario. ### Question 7 A hospital's security team wants to monitor for unauthorized access attempts across all device types on its network. Which device type would pose the greatest challenge to standard system monitoring because it uses specialized instruction sets and has minimal storage for logging software? - (A) An embedded computer controlling an IV pump in the intensive care unit - (B) A laptop used by a nurse for electronic health record access and documentation - (C) A server providing DNS and DHCP services to all devices on the hospital network - (D) A smartphone used by physicians to receive patient alert notifications and messages **Answer: (A)** Recognizing embedded computers as a distinct category with hardware constraints that limit monitoring reveals why they are uniquely difficult to secure. Embedded devices run specialized instruction sets for their specific machine components and have minimal storage, making it impractical to install logging agents or monitoring software directly on the device. ### Question 8 A network administrator sets up traffic monitoring on a water treatment plant's control network and detects repeated unauthorized connection attempts targeting port 502, which is used by the plant's pump controllers. What type of computing device are these pump controllers, and why does their device category make attack detection especially critical? - (A) They are embedded computers controlling critical infrastructure, so a successful attack could disrupt essential public services - (B) They are personal computers managing plant operations, so a successful attack would only affect individual user productivity - (C) They are server computers providing data services, so a successful attack would only expose stored operational records - (D) They are handheld computers used by technicians, so a successful attack would only compromise mobile communication data **Answer: (A)** Identifying pump controllers as embedded computers within the IoT category for critical infrastructure connects device type to risk level. Embedded computers in water treatment plants control physical processes that affect public safety, meaning a successful attack could manipulate pumps to disrupt or contaminate water supplies, making continuous monitoring of these devices essential. ### Question 9 A security analyst reviewing endpoint logs notices that a smartwatch on the corporate network sent a burst of data to an external IP address at 3 a.m. Compared to monitoring a desktop workstation for the same behavior, what challenge does the smartwatch's device category create for the analyst? - (A) Handheld computers like smartwatches run on battery power and have limited storage, restricting the depth of local logs available for forensic review - (B) Handheld computers like smartwatches have more processing power than servers, making log analysis slower and more resource-intensive for analysts - (C) Handheld computers like smartwatches provide services to other network devices, so their logs contain data from many users rather than one individual - (D) Handheld computers like smartwatches use specialized instruction sets for physical machinery, preventing standard network monitoring tools from reading their traffic **Answer: (A)** Applying knowledge of handheld computer characteristics to a monitoring scenario reveals a practical detection challenge. Smartwatches are handheld computers that run on battery power and have less storage than desktop personal computers, meaning they generate shallower local logs and may not retain detailed forensic data that an analyst needs to reconstruct the full scope of the suspicious transfer. ### Question 10 A hospital's embedded insulin pump controllers have not received a firmware update in two years, and a known critical vulnerability in their software was publicly disclosed six months ago. Which combination of layered security controls would most directly address this situation? - (A) Apply the firmware patch immediately and segment the devices on an isolated network to limit exploit reach - (B) Install anti-malware software on the pumps and require users to change their passwords every 90 days - (C) Enable a firewall on the hospital's perimeter router and disable autorun on all connected USB drives - (D) Add a BIOS password to each pump controller and configure open ports to require multi-factor authentication **Answer: (A)** Patching removes the known vulnerability that adversaries can exploit, while network segmentation limits an attacker's ability to pivot to other systems if a device is compromised. Together these controls address both the root cause and the blast radius of a successful exploit on critical medical devices. ## Review the Unit - [4.1 Device Vulnerabilities and Attacks](/ap-cybersecurity/unit-4/device-vulnerabilities-and-attacks/study-guide/HACz1L7MBGLXO5AANWlK) - [4.2 Authentication](/ap-cybersecurity/unit-4/authentication/study-guide/8fehxw1s1LZlYi1K3rm7) - [4.3 Protecting Devices](/ap-cybersecurity/unit-4/protecting-devices/study-guide/n86HF5aR65a2DLQwNHDn) - [4.4 Detecting Attacks on Devices](/ap-cybersecurity/unit-4/detecting-attacks-on-devices/study-guide/JpiXN2cti74uJERazuw3) ## Other Unit Tests - [Unit 1: Introduction to Security](/ap-cybersecurity/unit-test/1) - [Unit 2: Securing Spaces](/ap-cybersecurity/unit-test/2) - [Unit 3: Securing Networks](/ap-cybersecurity/unit-test/3) - [Unit 5: Securing Applications and Data](/ap-cybersecurity/unit-test/5) ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)