AP Cybersecurity, AP exams

Unit 3: Securing Networks

Unit 3 covers attacks that travel over networks and the controls that stop them: policies and other managerial controls, wireless security, dividing a network into segments, and placing and writing firewall rules. It ends with reading network logs for signs that an attack is under way, the kind of evidence the free-response question presents.

Position: 3 of 5 units
Topics covered: 4 topics in this guide

What is covered

Topics inside this unit.

These topics describe the scope students most often review for this part of AP Cybersecurity. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Network attacks: Eavesdropping, spoofing, and denial-of-service attacks, and what each needs to succeed.
Managerial controls and wireless security: Acceptable-use and access policies, and securing wireless networks with strong encryption and settings.
Segmentation and firewalls: Separating networks by trust level, where a firewall sits, and reading allow and deny rules in order.
Network logs and indicators of compromise: Spotting scans, unusual traffic, and repeated failures in network records.

Study tips

How to practice Unit 3: Securing Networks.

Section-specific guidance that follows from how this material is usually tested.

Trace a packet through a set of firewall rules top to bottom until the first match; order changes the outcome.
Practice reading short log excerpts and naming the attack they suggest.
Explain segmentation in terms of what an attacker can reach after breaking into one segment.

Where this fits

Unit 3: Securing Networks is 3 of 5 units in the AP Cybersecurity guide. Use the full guide to balance it against everything else you have to review.

Back to the AP Cybersecurity guide Official exam information

Sample Unit 3: Securing Networks questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Foundational
On an open coffee-shop Wi-Fi network, an attacker quietly captures other customers' unencrypted traffic in order to read what they send. What type of network attack is this?
1. ADenial of service
2. BSpoofing
3. CPassword spraying
4. DEavesdropping
Show answer
Answer: D. Eavesdropping
Passively capturing and reading traffic is eavesdropping, also called sniffing, and it threatens confidentiality rather than availability. Spoofing is the tempting choice, but spoofing means forging an address or identity to impersonate someone, which this attacker never does.
Key insight: Eavesdropping is listening, spoofing is impersonating, and denial of service is flooding.
Question 2Foundational
Which Wi-Fi security protocol is the newest and strongest standard that a small office should enable when all of its devices support it?
1. AWEP
2. BWPA
3. CWPA3
4. DWPA2
Show answer
Answer: C. WPA3
WPA3 is the current Wi-Fi security standard, and it protects passphrase-based networks better against offline password guessing than earlier versions. WPA2 is the tempting choice because it is still common, but it is the older standard, and WEP and the original WPA are broken and should never be used.
Key insight: Choose WPA3 when devices support it, and never use WEP.
Question 3Advanced
A firewall checks its rules from top to bottom, applies the first rule that matches, and denies anything that matches no rule. Rule 1: allow TCP from any source to 10.0.0.5 port 443. Rule 2: deny all traffic from 203.0.113.0/24. Rule 3: allow TCP from any source to 10.0.0.5 port 22. What happens to an HTTPS connection on TCP port 443 from 203.0.113.7 to 10.0.0.5?
1. AIt is allowed by Rule 1
2. BIt is denied by Rule 2
3. CIt is allowed by Rule 3
4. DIt is denied by the default deny
Show answer
Answer: A. It is allowed by Rule 1
The connection matches Rule 1, which allows port 443 to 10.0.0.5 from any source, and with first-match processing the firewall stops there. Rule 2 is the tempting answer because the source is in the blocked range, but a later rule is never reached once an earlier one has matched, so that deny would only work if it sat above Rule 1.
Key insight: Firewalls stop at the first match, so place specific denies above broad allows.
Question 4Intermediate
A company runs a public web server and an internal payroll database. Where should the web server be placed so that an attacker who takes it over cannot directly reach the internal network?
1. AOn the internal network beside the database
2. BIn a DMZ screened from the internal network
3. COn the staff Wi-Fi network with the laptops
4. DDirectly on the internet with no firewall at all
Show answer
Answer: B. In a DMZ screened from the internal network
A DMZ, or screened subnet, holds internet-facing servers in their own segment, and firewall rules block connections from that segment into the internal network. Placing the server beside the database is the tempting convenience, but then a compromised web server is one step away from the payroll data.
Key insight: Put public-facing servers in a DMZ so that a breach there stays there.
Question 5Intermediate
A firewall log shows one external IP address attempting connections to ports 21, 22, 23, 25, 80, 110, 443, and 3389 on the same server within two seconds, with most attempts refused. What activity does this pattern most likely show?
1. AA distributed denial-of-service attack
2. BA password-spraying attack
3. CA port scan
4. DNormal web browsing
Show answer
Answer: C. A port scan
Rapid attempts against many different ports on one host from a single source are reconnaissance: someone is mapping which services are open. A denial-of-service attack is the tempting answer, but it aims to overwhelm a service with volume, usually from many sources, rather than briefly touching each port once.
Key insight: Many ports from one source in seconds means someone is scanning for a way in.

Continue through AP Cybersecurity

Practice Unit 3: Securing Networks deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Unit 3: Securing Networks