Secure

Overview

AP Networking Secure is Skill Category 2, the set of skills you use to protect data, devices, and networks from vulnerabilities. In this skill you identify weaknesses, choose mitigation strategies, put security controls in place, document them, and then verify those controls actually work without blocking legitimate access.

Think of yourself as a network technician who has to lock things down while keeping the network usable. The CED organizes this work around three types of security controls: protective, detective, and deterrent. You will use all three across the course, sometimes with AI support and sometimes without.

What Secure Means

Secure means applying security controls to reduce risk while keeping the network available to the people who need it. The CED names three control types:

• Protective controls stop or block threats before they cause harm. Examples: firewalls, encryption, strong passwords, access restrictions.
• Detective controls notice and alert you when something is wrong. Examples: logging, monitoring, intrusion detection, scanning tools.
• Deterrent controls discourage attackers from trying in the first place. Examples: warning banners, visible monitoring notices, account lockout policies.

Good security is a balance. A control that locks down a device so hard that nobody can use it has failed the availability test. The Secure skill always pairs mitigation with "maintain access and availability."

What This Skill Requires

To work through a Secure task, you move through four connected steps:

1. Identify what is vulnerable and what could happen if it is exploited.
2. Determine which mitigation strategy fits the vulnerability.
3. Implement and document the security controls you chose.
4. Verify the control works, keeps the network available, and troubleshoot if it does not.

AI shows up as a support tool for identifying vulnerabilities, suggesting mitigations, and monitoring networks. You are expected to work both with AI and without it, so you need to understand the reasoning, not just copy an AI suggestion.

Subskills You Need

2.A Identify vulnerabilities and explain controls

Spot weaknesses in data, devices, and networks and describe their impact. Then explain how security controls, with or without AI, can mitigate the weakness and monitor the network.

• Example impact statements: an open port could let an attacker in; weak Wi-Fi encryption could expose traffic; an unpatched device could be taken over.
• Connect each vulnerability to a control type (protective, detective, or deterrent).

2.B Determine mitigation strategies

Choose how to fix or reduce a vulnerability. You should be able to weigh options with and without AI help.

• Match the strategy to the problem. A missing firewall rule calls for a protective fix. No visibility into traffic calls for a detective fix like logging or monitoring.

2.C Implement and document security controls

Put the control in place and write down what you did and why. Documentation matters because other technicians need to understand your changes and you need a record for later verification.

• Record the vulnerability, the control applied, settings used, and the date or reason for the change.

2.D Verify controls and troubleshoot

Confirm the control actually fixes the intended vulnerability while keeping access and availability. If something breaks, troubleshoot it.

• Test that the threat is blocked AND that authorized users can still do their work.
• If a new firewall rule blocks legitimate traffic, you adjust and retest.

How It Shows Up on the AP Exam

Here is what the published framework says and what it does not.

• The May 2027 pilot exam is digital and multiple choice only. College Board has not published question counts, timing, or weighting.
• Questions place you in the role of a network technician or administrator using workplace scenarios.
• A free-response section built on networking artifacts begins with the national exam in May 2028. There is no pilot practice exam.
• All four Secure subskills (2.A, 2.B, 2.C, 2.D) apply to both MCQ and FRQ.

Practical tip: expect scenario questions where you read a situation, identify the vulnerability, and pick the control that fixes it without breaking access. That maps directly to the four subskills.

Examples Across the Course

Secure work appears in every unit as networks grow in size and complexity.

• Unit 1, securing a single device (topic 1.4 Locking It Down): You identify that a laptop has no screen lock and outdated software. Mitigation: enable automatic updates (protective) and set a lock timeout (deterrent). Verify the device still runs the apps the user needs.
• Unit 2, securing a SOHO network (topic 2.6 Applying Defense): You find the home router still uses default admin credentials and weak Wi-Fi security. Mitigation: change credentials, upgrade to stronger encryption (protective), and enable router logs (detective). Document the new settings so the change is traceable.
• Unit 3, segmentation and filtering (topics 3.4 and 3.5): You separate a guest VLAN from internal devices and add firewall rules to filter traffic. Verify guests reach the internet but cannot reach internal servers, and that internal users keep full access.
• Unit 4, defending a large network (topic 4.5 Monitoring and Defending): You set up monitoring to detect unusual traffic across many connections. The detective control alerts you to a spike, and you document and respond. This shows the "monitor networks" piece of 2.A and 2.C at scale.

Notice how the same four steps repeat, but the scope grows from one device to a global-scale network.

How to Practice Secure

• For any scenario, write a one-line vulnerability statement and a one-line impact statement before choosing a fix.
• Label every control you pick as protective, detective, or deterrent. If you cannot label it, you may not understand what it does.
• Practice the availability check. After every mitigation, ask "can authorized users still do their job?"
• Document changes in a simple table: vulnerability, control, control type, verification result.
• Try a task twice, once reasoning on your own and once comparing with an AI suggestion, then explain any difference.

Sample documentation table:

Common Mistakes

• Fixing the vulnerability but breaking access. A control that blocks everyone, including valid users, fails 2.D. Always test availability.
• Confusing the three control types. Logging is detective, not protective. A firewall rule is protective. A warning banner is deterrent.
• Skipping documentation. 2.C requires it. An undocumented change is hard to verify or reverse.
• Treating AI output as final. You still need to justify the mitigation yourself. The CED expects reasoning with and without AI.
• Naming a control without connecting it to the vulnerability. State what weakness it addresses and why.

Quick Review

• Secure = identify vulnerabilities, choose mitigations, implement and document controls, then verify.
• Three control types: protective (block), detective (notice), deterrent (discourage).
• Always balance security with access and availability.
• Document what you change and why, then test both the fix and normal use.
• The skill scales from one device (Unit 1) to a global network (Unit 4), using the same four steps.
• Pilot exam is multiple choice; FRQ with artifacts starts in May 2028.