AP Cybersecurity, AP exams

Unit 2: Securing Spaces

Unit 2 covers physical security: how attackers get into buildings and rooms, the barriers and controls that keep them out, and how intrusions are noticed. It is also where adversarial thinking is practiced directly, by looking at a space the way an intruder would before deciding how to defend it.

Position: 2 of 5 units
Topics covered: 4 topics in this guide

What is covered

Topics inside this unit.

These topics describe the scope students most often review for this part of AP Cybersecurity. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Physical weak points: Doors, badges, tailgating, and unattended equipment as routes into a space.
Physical safeguards: Locks, access cards, barriers, and visitor rules, layered so one failure is not enough.
Detecting physical intrusion: Cameras, alarms, and access records, and what each can and cannot show.
Adversarial thinking: Planning an attack on paper to find the gaps a defense must close.

Study tips

How to practice Unit 2: Securing Spaces.

Section-specific guidance that follows from how this material is usually tested.

Walk through a familiar building and list every way in; then match each to a control.
Practice choosing a deterrent, a preventive, and a detective control for the same weak point.
Remember that physical access often defeats digital controls; questions test that link.

Where this fits

Unit 2: Securing Spaces is 2 of 5 units in the AP Cybersecurity guide. Use the full guide to balance it against everything else you have to review.

Back to the AP Cybersecurity guide Official exam information

Sample Unit 2: Securing Spaces questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Foundational
What is the name for an intruder slipping through a badge-controlled door right behind an authorized employee, before the door closes, without presenting a badge of their own?
1. AShoulder surfing
2. BDumpster diving
3. CTailgating
4. DPretexting
Show answer
Answer: C. Tailgating
Tailgating exploits courtesy and inattention: the intruder rides on someone else's valid entry instead of defeating the lock. Shoulder surfing is a different weak point, watching someone enter a code or password, and it does not involve following anyone through a door.
Key insight: One badge, one person: anyone who follows without badging in is tailgating.
Question 2Intermediate
Which physical control most directly prevents tailgating at a badge-controlled entrance?
1. AA camera that records everyone who enters
2. BA sign reminding staff to badge in alone
3. CA guard who reviews the entry logs every week
4. DA turnstile admitting one person per badge
Show answer
Answer: D. A turnstile admitting one person per badge
A turnstile or mantrap physically lets only one person through for each badge read, so a follower is blocked rather than merely noticed. A camera is the tempting choice, but it is a detective control that records the tailgater after the fact without stopping the entry.
Key insight: Cameras detect tailgating; turnstiles and mantraps prevent it.
Question 3Intermediate
A door-access log shows that an employee's badge opened the server room at 2:14 a.m. on a night when that employee was confirmed to be traveling overseas. What is the most reasonable conclusion?
1. ASomeone else used the badge or a copy of it
2. BThe employee entered the server room that night
3. CThe employee's account was hacked over the network
4. DThe log is unreliable and should be ignored
Show answer
Answer: A. Someone else used the badge or a copy of it
An access log records which credential was used, not who was holding it, so a badge entry while its owner is provably abroad points to a stolen, borrowed, or cloned badge. Concluding that the employee entered is the tempting mistake; matching the log against camera footage would show who actually came in.
Key insight: Badge logs identify the card, not the person; cameras help show who held it.
Question 4Advanced
A server room has a steel door with a high-security lock, but its drop ceiling opens into the space above an unlocked storage room next door. Thinking like an intruder, what is the weakest route into the server room?
1. ABy picking the door's high-security lock
2. BThrough the drop ceiling from the storage room
3. CBy prying the steel door open with tools
4. DBy drilling straight through the steel door panel
Show answer
Answer: B. Through the drop ceiling from the storage room
An intruder looks for the path of least resistance, and a ceiling space shared with an unlocked room bypasses the strong door and lock entirely. Picking or forcing the door is the tempting answer, but it attacks the strongest part of the defense, which adversarial thinking teaches you not to assume an attacker will choose.
Key insight: Attackers go around strong controls, so defend every route in, not just the door.
Question 5Foundational
True or false: layering physical controls, such as a fenced lot, a badge reader at the entrance, and a locked server cabinet, means an intruder must defeat more than one control to reach the equipment.
1. ATrue
2. BFalse
Show answer
Answer: A. True
Defense in depth stacks independent controls so that one failure, such as a propped-open door, does not hand an intruder the equipment. Each layer also buys time for detection, which is why layered safeguards are preferred over a single strong barrier.
Key insight: Layer controls so that no single failure opens the way in.

Continue through AP Cybersecurity

Practice Unit 2: Securing Spaces deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Unit 2: Securing Spaces