# AP Cybersecurity exam guide > The five AP Cybersecurity units, the three tested skill categories with their exam weightings, and the device security free-response question. - Canonical page: https://www.arcadesacademy.com/exams/ap-cybersecurity - Markdown source: https://www.arcadesacademy.com/exams/ap-cybersecurity/llms.txt - Exam family: AP exams - Governing body: College Board - Official exam information: https://apstudents.collegeboard.org/courses/ap-cybersecurity - Who takes it: High school students interested in security and technology careers who want college credit and an employer-endorsed credential, with or without prior computing courses. - Follows the fall 2026 course and exam description, from 5 May 2027 ## Overview AP Cybersecurity teaches how to protect people, places, networks, devices, and data by thinking like an attacker and layering defenses. It is one of College Board's AP Career Kickstart courses, built with employers and security organizations, and its first AP Exam is in May 2027. The course has five units, from security basics through applications and data. College Board weights the exam by skill rather than by unit: analyzing risk, mitigating risk, and detecting attacks each account for 25 to 40% of it, across all five units. The free-response section is a single multi-part analysis of one device from several sources, such as firewall rules, logs, and file permissions, so reading evidence carefully matters as much as knowing terms. Arcade Academy is an independent study workspace. Use the official Course and Exam Description and its clarifications as the authority, and use the pages below to organize review of each unit. ## Exam format - **Section I:** 60 multiple-choice questions in 80 minutes, 70% of the score - **Section II:** 1 multi-part free-response question in 50 minutes, 30% of the score: a security analysis of one device from about six sources - **Skill weighting:** Analyze risk, mitigate risk, and detect attacks, each 25 to 40% of the exam - **Delivery:** Fully digital in College Board's Bluebook app - **First exam:** Wednesday 5 May 2027 - **Score scale:** 1 to 5 ## Scoring The multiple-choice section contributes 70% and the device security analysis 30% of a composite score, which College Board converts to the reported 1 to 5 scale. There is no performance task or portfolio. Colleges set their own credit and placement policies. ## Units AP Cybersecurity is organized into 5 units. Each one below lists its published weighting where the governing body publishes one, the topics it covers, and study tips specific to it. ### 1. Unit 1: Introduction to Security - Position: 1 of 5 - Page: https://www.arcadesacademy.com/exams/ap-cybersecurity/unit-1-introduction-to-security Unit 1 sets up the course's way of thinking: who attacks and why, how people are tricked into giving access, and why weak logins are the easiest way in. It covers stronger authentication, such as multifactor sign-in, passphrases, and account lockouts, and the ways AI tools help both attackers and defenders. #### Topics - **Adversaries and motives** — The kinds of attackers, from opportunists to organized groups, and what each is after. - **Social engineering** — Phishing, pretexting, and other tricks that exploit trust instead of technology. - **Password attacks and stronger authentication** — Guessing, reuse, and cracking, and the defenses of multifactor sign-in, passphrases, and lockouts. - **AI in security** — How AI tools speed up attacks such as convincing phishing, and how defenders use them to spot threats. #### Study tips - For each social-engineering trick, name the human tendency it exploits and the habit that defeats it. - Compare authentication factors by what an attacker would need to steal to beat each one. - Keep a running list of AI uses on both sides; questions can ask about either. ### 2. Unit 2: Securing Spaces - Position: 2 of 5 - Page: https://www.arcadesacademy.com/exams/ap-cybersecurity/unit-2-securing-spaces Unit 2 covers physical security: how attackers get into buildings and rooms, the barriers and controls that keep them out, and how intrusions are noticed. It is also where adversarial thinking is practiced directly, by looking at a space the way an intruder would before deciding how to defend it. #### Topics - **Physical weak points** — Doors, badges, tailgating, and unattended equipment as routes into a space. - **Physical safeguards** — Locks, access cards, barriers, and visitor rules, layered so one failure is not enough. - **Detecting physical intrusion** — Cameras, alarms, and access records, and what each can and cannot show. - **Adversarial thinking** — Planning an attack on paper to find the gaps a defense must close. #### Study tips - Walk through a familiar building and list every way in; then match each to a control. - Practice choosing a deterrent, a preventive, and a detective control for the same weak point. - Remember that physical access often defeats digital controls; questions test that link. ### 3. Unit 3: Securing Networks - Position: 3 of 5 - Page: https://www.arcadesacademy.com/exams/ap-cybersecurity/unit-3-securing-networks Unit 3 covers attacks that travel over networks and the controls that stop them: policies and other managerial controls, wireless security, dividing a network into segments, and placing and writing firewall rules. It ends with reading network logs for signs that an attack is under way, the kind of evidence the free-response question presents. #### Topics - **Network attacks** — Eavesdropping, spoofing, and denial-of-service attacks, and what each needs to succeed. - **Managerial controls and wireless security** — Acceptable-use and access policies, and securing wireless networks with strong encryption and settings. - **Segmentation and firewalls** — Separating networks by trust level, where a firewall sits, and reading allow and deny rules in order. - **Network logs and indicators of compromise** — Spotting scans, unusual traffic, and repeated failures in network records. #### Study tips - Trace a packet through a set of firewall rules top to bottom until the first match; order changes the outcome. - Practice reading short log excerpts and naming the attack they suggest. - Explain segmentation in terms of what an attacker can reach after breaking into one segment. ### 4. Unit 4: Securing Devices - Position: 4 of 5 - Page: https://www.arcadesacademy.com/exams/ap-cybersecurity/unit-4-securing-devices Unit 4 moves to individual computers and other devices: the weaknesses they carry, how users and processes are authenticated on them, and protections such as anti-malware and secure settings. It finishes with host logs and how to find evidence of an attack on a single device, which is the setting of the free-response analysis. #### Topics - **Device vulnerabilities** — Unpatched software, default settings, and excess permissions as ways into a device. - **Device authentication and permissions** — Accounts, privileges, and file permissions, and the principle of least privilege. - **Malware protection** — How malware spreads and how anti-malware tools, updates, and hardening reduce the risk. - **Host logs** — Reading system and application logs for signs of misuse or compromise on one device. #### Study tips - Practice the free-response shape: list the issues in a device's sources, the attack evidence, and the effect of each fix. - Learn to read a file-permission listing quickly and say who can read, change, or run each file. - Tie every hardening step to the vulnerability it closes. ### 5. Unit 5: Securing Applications and Data - Position: 5 of 5 - Page: https://www.arcadesacademy.com/exams/ap-cybersecurity/unit-5-securing-applications-and-data Unit 5 covers attacks on software and stored information and the defenses against them: access controls that limit who sees what, encryption of stored data, and public-key cryptography for sharing it safely. It also covers detecting attacks on applications and data, which draws on the log-reading skills of the earlier units. #### Topics - **Application and data attacks** — Injection, data theft, and tampering, and the application flaws that allow them. - **Access control** — Granting the least access needed, and models for deciding who can use which data. - **Encryption and public-key cryptography** — Encrypting stored data, and how key pairs let strangers share secrets and verify senders. - **Detecting application and data attacks** — Signs in application records that data was accessed or changed without permission. #### Study tips - Draw who holds which key when two people exchange a public-key message; questions turn on that. - Separate protecting data at rest from protecting it in transit, and name a control for each. - Practice spotting an injection attempt in a short input or log line. ## Study strategies - Study every unit through the three tested skills: for each topic, practice analyzing the risk, choosing a mitigation, and naming how you would detect an attack. - Practice the device security analysis with several sources side by side, since the free-response question gives firewall rules, logs, permissions, and a policy together. - Read short logs and rule sets often; evidence-reading questions reward speed and care. - Think like an attacker before choosing a defense, and prefer layered controls over a single fix. - Use the official course description's practice questions over pilot-year materials, since the pilot exam's timing differed. ## Frequently asked questions ### How is the AP Cybersecurity Exam structured? Section I is 60 multiple-choice questions in 80 minutes, worth 70% of the score. Section II is one multi-part free-response question in 50 minutes, worth 30%, in which you analyze about six sources describing one device and explain the problems, the attack evidence, and the effect of changes. The exam is taken in Bluebook. ### Why does this guide show no unit weightings? College Board weights the AP Cybersecurity Exam by skill category instead of by unit: analyzing risk, mitigating risk, and detecting attacks each make up 25 to 40% of the exam, drawn from all five units. ### When is the first exam? The first AP Cybersecurity Exam is on Wednesday 5 May 2027, on College Board's 2027 AP Exam schedule. Confirm the date and the late-testing option with your school's AP coordinator. ### Does passing the exam give me an industry certification? No. College Board offers its own AP Career Kickstart credential for students who complete the course and reach a qualifying exam score, and describes the course as aligned with some industry certifications, but it does not award them. Those are separate exams from their own providers. ### Is Arcade Academy affiliated with College Board? No. AP® is a registered trademark of College Board, which was not involved in the production of, and does not endorse, this site. Arcade Academy is an independent educational resource. ## Related exam guides - [AP Computer Science Principles](https://www.arcadesacademy.com/exams/ap-computer-science-principles): All five AP Computer Science Principles big ideas with published exam weightings, plus the Create performance task. - [Network Associate 200-301](https://www.arcadesacademy.com/exams/network-associate): Practice for topics on the Cisco® CCNA® exam, version 2.0: the five exam domains with their published weights and what each one tests. - [AP Computer Science A](https://www.arcadesacademy.com/exams/ap-computer-science-a): Java programming across the four units of the revised AP Computer Science A framework, with published exam weightings. ## Independence and trademark notice AP® is a registered trademark of College Board, which was not involved in the production of, and does not endorse, this site. Arcade Academy is an independent educational resource. Confirm current exam format and dates with College Board directly. AP® is a registered trademark of College Board, which was not involved in the production of, and does not endorse, this site. Arcade Academy is an independent educational resource.