AP Cybersecurity, AP exams

Unit 1: Introduction to Security

Unit 1 sets up the course's way of thinking: who attacks and why, how people are tricked into giving access, and why weak logins are the easiest way in. It covers stronger authentication, such as multifactor sign-in, passphrases, and account lockouts, and the ways AI tools help both attackers and defenders.

Position: 1 of 5 units
Topics covered: 4 topics in this guide

What is covered

Topics inside this unit.

These topics describe the scope students most often review for this part of AP Cybersecurity. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Adversaries and motives: The kinds of attackers, from opportunists to organized groups, and what each is after.
Social engineering: Phishing, pretexting, and other tricks that exploit trust instead of technology.
Password attacks and stronger authentication: Guessing, reuse, and cracking, and the defenses of multifactor sign-in, passphrases, and lockouts.
AI in security: How AI tools speed up attacks such as convincing phishing, and how defenders use them to spot threats.

Study tips

How to practice Introduction to Security.

Section-specific guidance that follows from how this material is usually tested.

For each social-engineering trick, name the human tendency it exploits and the habit that defeats it.
Compare authentication factors by what an attacker would need to steal to beat each one.
Keep a running list of AI uses on both sides; questions can ask about either.

Where this fits

Unit 1: Introduction to Security is 1 of 5 units in the AP Cybersecurity guide. Use the full guide to balance it against everything else you have to review.

Back to the AP Cybersecurity guide Official exam information

Sample Introduction to Security questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Foundational
What kind of attacker breaks into systems mainly to promote a political or social cause, for example by defacing a government website with a protest message?
1. AA cybercriminal
2. BA hacktivist
3. CA script kiddie
4. DAn insider
Show answer
Answer: B. A hacktivist
Hacktivists attack to draw attention to a cause, so a public defacement carrying a protest message fits their motive. A cybercriminal is the tempting choice, but criminals are usually after money, such as ransom payments or data they can sell, rather than publicity.
Key insight: Ask what the attacker wants: money points to criminals, a message points to hacktivists.
Question 2Foundational
An email that appears to come from a school's IT department warns that a student's account will be deleted within 24 hours unless the student signs in through a link to itdept-school-verify.com, a domain the school does not own. What type of attack is this message?
1. APretexting
2. BBaiting
3. CCredential stuffing
4. DPhishing
Show answer
Answer: D. Phishing
A deceptive email that fakes a trusted sender, creates urgency, and sends the reader to a lookalike sign-in link to harvest credentials is phishing. Pretexting also uses a false story, but it centers on an invented identity and a back-and-forth conversation, usually by phone or in person, rather than a lure email with a malicious link.
Key insight: Urgency plus a link to a domain the sender does not own is a classic phishing sign.
Question 3Intermediate
A sign-in page asks for a password and then for a six-digit code shown in an authenticator app on the user's phone. Which two authentication factor categories does this combine?
1. ASomething you know and something you are
2. BSomething you have and something you are
3. CSomething you know and something you have
4. DSomething you know, checked two separate times
Show answer
Answer: C. Something you know and something you have
The password is something you know, and the code proves possession of the phone that generates it, which is something you have. It is not something you are, because no biometric trait such as a fingerprint or face is checked, and it is not the same factor twice, because the code depends on a physical device.
Key insight: A code from your phone proves something you have, not something you know.
Question 4Advanced
Attackers take username and password pairs leaked in another website's breach and try them on a school's student portal, hoping students reused their passwords. Which control most directly stops a correct but stolen password from being enough to sign in?
1. AAdding multifactor authentication to sign-in
2. BLocking an account after five failed attempts
3. CForcing every password to expire after 30 days
4. DRequiring at least one symbol in each password
Show answer
Answer: A. Adding multifactor authentication to sign-in
With multifactor authentication, a stolen password alone fails because the attacker also needs a second factor, such as the student's phone. Account lockout is tempting, but credential stuffing often uses the right password on the first try, so there are few failed attempts to trigger a lockout.
Key insight: Lockouts stop guessing; only a second factor stops a correct stolen password.
Question 5Intermediate
Attackers now use AI tools to write phishing messages with flawless grammar and accurate personal details. Which defensive habit still works when a suspicious request has no obvious errors?
1. AChecking the whole message carefully for spelling mistakes
2. BVerifying the request through a separate known channel
3. CTrusting messages that mention your name and school
4. DReplying to the same sender to ask whether it is real
Show answer
Answer: B. Verifying the request through a separate known channel
Contacting the supposed sender through a phone number or address you already trust, not one given in the message, checks the request itself, so it works no matter how polished the text is. Looking for spelling mistakes is the tempting habit, but AI-written lures often have none, and replying to the message only reaches the attacker.
Key insight: When AI makes fakes look perfect, verify the request through a channel you already trust.

Continue through AP Cybersecurity

Practice Introduction to Security deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Unit 1: Introduction to Security