AP Cybersecurity, AP exams

Unit 4: Securing Devices

Unit 4 moves to individual computers and other devices: the weaknesses they carry, how users and processes are authenticated on them, and protections such as anti-malware and secure settings. It finishes with host logs and how to find evidence of an attack on a single device, which is the setting of the free-response analysis.

Position: 4 of 5 units
Topics covered: 4 topics in this guide

What is covered

Topics inside this unit.

These topics describe the scope students most often review for this part of AP Cybersecurity. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Device vulnerabilities: Unpatched software, default settings, and excess permissions as ways into a device.
Device authentication and permissions: Accounts, privileges, and file permissions, and the principle of least privilege.
Malware protection: How malware spreads and how anti-malware tools, updates, and hardening reduce the risk.
Host logs: Reading system and application logs for signs of misuse or compromise on one device.

Study tips

How to practice Unit 4: Securing Devices.

Section-specific guidance that follows from how this material is usually tested.

Practice the free-response shape: list the issues in a device's sources, the attack evidence, and the effect of each fix.
Learn to read a file-permission listing quickly and say who can read, change, or run each file.
Tie every hardening step to the vulnerability it closes.

Where this fits

Unit 4: Securing Devices is 4 of 5 units in the AP Cybersecurity guide. Use the full guide to balance it against everything else you have to review.

Back to the AP Cybersecurity guide Official exam information

Sample Unit 4: Securing Devices questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Intermediate
A file on a Linux system has the permission string -rwxr-x---. What can members of the file's group do with it?
1. ARead, change, and run it
2. BRead and run it, but not change it
3. CRead it, but neither change nor run it
4. DNothing; they have no access
Show answer
Answer: B. Read and run it, but not change it
After the leading file-type character, the string splits into owner rwx, group r-x, and others ---, so group members can read and execute the file but cannot write to it. Read, change, and run describes the owner's rwx, and no access describes everyone else, which are the tempting misreadings of the three triplets.
Key insight: Read permission strings in threes after the type: owner, group, others.
Question 2Foundational
A student intern only needs to look at reports in one shared folder. Under the principle of least privilege, what access should the intern's account get?
1. AAdministrator rights on the file server
2. BRead and write access to that folder
3. CRead access to every shared folder
4. DRead-only access to that one folder
Show answer
Answer: D. Read-only access to that one folder
Least privilege grants only the access a task requires, and viewing reports in one folder requires read access to that folder alone. Read and write access to the folder is the tempting middle ground, but write access would let a mistake or a stolen account change or delete the reports.
Key insight: Grant exactly what the job needs and nothing more.
Question 3Foundational
A school installs network cameras that still accept the manufacturer's default login of admin and admin. Which action best fixes this vulnerability?
1. AReplace the default login with a unique strong password
2. BHide the wireless network name the cameras connect to
3. CSchedule every camera to restart automatically each night
4. DInstall anti-malware software on all staff laptops
Show answer
Answer: A. Replace the default login with a unique strong password
Default credentials are published in manuals and online lists, so attackers try them first, and replacing them with a unique strong password closes that door. Hiding the network name is the tempting option, but it only obscures the network and leaves the camera's login exactly as easy to guess.
Key insight: Change every default password before a device goes live.
Question 4Intermediate
Within an hour of one unpatched computer becoming infected, dozens of other unpatched computers on the same network are infected too, even though no one opened a file, link, or attachment on them. What type of malware best fits this behavior?
1. AA virus
2. BA trojan
3. CA worm
4. DA rootkit
Show answer
Answer: C. A worm
A worm copies itself across a network by exploiting a vulnerability, so it spreads from machine to machine without anyone opening anything. A virus is the tempting answer, but a virus attaches to a host file or program and spreads only when that file is run.
Key insight: Spreads on its own: worm. Needs someone to run an infected file: virus.
Question 5Advanced
A workstation's security log shows 40 failed logins for the administrator account between 2:00 and 2:05 a.m., a successful administrator login at 2:06, and a new administrator account named support2 created at 2:08. What does this sequence most likely indicate?
1. AA routine overnight update adding a service account
2. BA denial-of-service attack locking out the admin account
3. CAn administrator who forgot a password, then reset it
4. DA guessed password followed by a new backdoor account
Show answer
Answer: D. A guessed password followed by a new backdoor account
Repeated failures followed by a success on the same account suggest a password guess that worked, and quickly creating a new administrator account is a common way for an intruder to keep access. A forgetful administrator is the tempting explanation, but resetting a password does not require creating a second admin account minutes later in the middle of the night.
Key insight: Failures, then a success, then a new admin account: treat it as a compromise.

Continue through AP Cybersecurity

Practice Unit 4: Securing Devices deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Unit 4: Securing Devices