AP exams, 5 units
AP Cybersecurity exam guide
The five AP Cybersecurity units, the three tested skill categories with their exam weightings, and the device security free-response question.
Follows the fall 2026 course and exam description, from 5 May 2027
Overview
What AP Cybersecurity covers.
AP Cybersecurity teaches how to protect people, places, networks, devices, and data by thinking like an attacker and layering defenses. It is one of College Board's AP Career Kickstart courses, built with employers and security organizations, and its first AP Exam is in May 2027. The course has five units, from security basics through applications and data.
College Board weights the exam by skill rather than by unit: analyzing risk, mitigating risk, and detecting attacks each account for 25 to 40% of it, across all five units. The free-response section is a single multi-part analysis of one device from several sources, such as firewall rules, logs, and file permissions, so reading evidence carefully matters as much as knowing terms.
Arcade Academy is an independent study workspace. Use the official Course and Exam Description and its clarifications as the authority, and use the pages below to organize review of each unit.
At a glance
- Section I
- 60 multiple-choice questions in 80 minutes, 70% of the score
- Section II
- 1 multi-part free-response question in 50 minutes, 30% of the score: a security analysis of one device from about six sources
- Skill weighting
- Analyze risk, mitigate risk, and detect attacks, each 25 to 40% of the exam
- Delivery
- Fully digital in College Board's Bluebook app
- First exam
- Wednesday 5 May 2027
- Score scale
- 1 to 5
- Governing body
- College Board
- Who takes it
- High school students interested in security and technology careers who want college credit and an employer-endorsed credential, with or without prior computing courses.
Scoring
The multiple-choice section contributes 70% and the device security analysis 30% of a composite score, which College Board converts to the reported 1 to 5 scale. There is no performance task or portfolio. Colleges set their own credit and placement policies.
Exam structure
Units
AP Cybersecurity covers 5 units. Open one for its topics, published weighting, and section-specific study tips.
Unit 1: Introduction to Security
Unit 1 sets up the course's way of thinking: who attacks and why, how people are tricked into giving access, and why weak logins…
4 topics
Unit 2: Securing Spaces
Unit 2 covers physical security: how attackers get into buildings and rooms, the barriers and controls that keep them out, and…
4 topics
Unit 3: Securing Networks
Unit 3 covers attacks that travel over networks and the controls that stop them: policies and other managerial controls, wireless…
4 topics
Unit 4: Securing Devices
Unit 4 moves to individual computers and other devices: the weaknesses they carry, how users and processes are authenticated on…
4 topics
Unit 5: Securing Applications and Data
Unit 5 covers attacks on software and stored information and the defenses against them: access controls that limit who sees what…
4 topics
Study strategies
How to work through this exam.
These strategies follow from the exam's own structure. Adapt them to the time you actually have each week.
- Study every unit through the three tested skills: for each topic, practice analyzing the risk, choosing a mitigation, and naming how you would detect an attack.
- Practice the device security analysis with several sources side by side, since the free-response question gives firewall rules, logs, permissions, and a policy together.
- Read short logs and rule sets often; evidence-reading questions reward speed and care.
- Think like an attacker before choosing a defense, and prefer layered controls over a single fix.
- Use the official course description's practice questions over pilot-year materials, since the pilot exam's timing differed.
Common questions
AP Cybersecurity questions students ask.
How is the AP Cybersecurity Exam structured?
Section I is 60 multiple-choice questions in 80 minutes, worth 70% of the score. Section II is one multi-part free-response question in 50 minutes, worth 30%, in which you analyze about six sources describing one device and explain the problems, the attack evidence, and the effect of changes. The exam is taken in Bluebook.
Why does this guide show no unit weightings?
College Board weights the AP Cybersecurity Exam by skill category instead of by unit: analyzing risk, mitigating risk, and detecting attacks each make up 25 to 40% of the exam, drawn from all five units.
When is the first exam?
The first AP Cybersecurity Exam is on Wednesday 5 May 2027, on College Board's 2027 AP Exam schedule. Confirm the date and the late-testing option with your school's AP coordinator.
Does passing the exam give me an industry certification?
No. College Board offers its own AP Career Kickstart credential for students who complete the course and reach a qualifying exam score, and describes the course as aligned with some industry certifications, but it does not award them. Those are separate exams from their own providers.
Is Arcade Academy affiliated with College Board?
No. AP® is a registered trademark of College Board, which was not involved in the production of, and does not endorse, this site. Arcade Academy is an independent educational resource.
Before you build the schedule
Exam structures change. Confirm the current format, eligibility, and policies with College Board before you commit to a study plan.
Official exam information opens in a new tabMarkdown version of this guide for citation, offline reading, and language models.
Study AP Cybersecurity with a plan you can keep.
Create your Arcade Academy workspace to pair this structure with spaced-repetition flashcards, resources, notes, and progress you can review.