AP Cybersecurity, AP exams

Unit 5: Securing Applications and Data

Unit 5 covers attacks on software and stored information and the defenses against them: access controls that limit who sees what, encryption of stored data, and public-key cryptography for sharing it safely. It also covers detecting attacks on applications and data, which draws on the log-reading skills of the earlier units.

Position: 5 of 5 units
Topics covered: 4 topics in this guide

What is covered

Topics inside this unit.

These topics describe the scope students most often review for this part of AP Cybersecurity. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Application and data attacks: Injection, data theft, and tampering, and the application flaws that allow them.
Access control: Granting the least access needed, and models for deciding who can use which data.
Encryption and public-key cryptography: Encrypting stored data, and how key pairs let strangers share secrets and verify senders.
Detecting application and data attacks: Signs in application records that data was accessed or changed without permission.

Study tips

How to practice Applications and Data.

Section-specific guidance that follows from how this material is usually tested.

Draw who holds which key when two people exchange a public-key message; questions turn on that.
Separate protecting data at rest from protecting it in transit, and name a control for each.
Practice spotting an injection attempt in a short input or log line.

Where this fits

Unit 5: Securing Applications and Data is 5 of 5 units in the AP Cybersecurity guide. Use the full guide to balance it against everything else you have to review.

Back to the AP Cybersecurity guide Official exam information

Sample Applications and Data questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Foundational
A web application's log shows that someone typed ' OR '1'='1' -- into the username field of its login form. What type of attack does this input indicate?
1. ACross-site scripting
2. BSQL injection
3. CBrute force
4. DDenial of service
Show answer
Answer: B. SQL injection
Quote marks, an always-true condition such as '1'='1', and a comment marker are signs that someone is trying to rewrite the database query the form builds, which is SQL injection. Cross-site scripting is the tempting choice, but it injects script code meant to run in other users' browsers, not database logic.
Key insight: Stray quotes, an always-true OR, and comment marks in a form field signal SQL injection.
Question 2Advanced
Which coding practice most effectively prevents SQL injection through a web application's login form?
1. AHiding database error messages from users
2. BEncrypting the database while it is stored
3. CUsing parameterized queries for all input
4. DLimiting the username field to 20 characters
Show answer
Answer: C. Using parameterized queries for all input
Parameterized queries, also called prepared statements, pass user input to the database strictly as data, so it can never run as part of the SQL command. Hiding error messages is the tempting choice because it makes attacks harder to refine, but the injection still works, and neither encryption at rest nor a length limit stops it either.
Key insight: Keep input as data: parameterized queries stop SQL injection at the source.
Question 3Intermediate
Alice wants to send Bob a message that only Bob can read, using public-key cryptography. Which key should Alice use to encrypt the message?
1. AAlice's private key
2. BBob's private key
3. CAlice's public key
4. DBob's public key
Show answer
Answer: D. Bob's public key
Anything encrypted with Bob's public key can be decrypted only with Bob's private key, which only Bob holds, so only Bob can read the message. Alice's private key is the tempting choice, but using it produces a signature that anyone with Alice's public key can check, so it proves who sent the message rather than keeping it secret.
Key insight: Encrypt with the recipient's public key; sign with the sender's private key.
Question 4Intermediate
A hospital system gives every nurse the same permissions by placing their accounts in a Nurse role, and when a nurse becomes a pharmacist, an administrator simply moves the account to the Pharmacist role. Which access control model is this?
1. ADiscretionary access control
2. BMandatory access control
3. CRole-based access control
4. DMultifactor authentication
Show answer
Answer: C. Role-based access control
Role-based access control attaches permissions to job roles and assigns users to roles, so a change of job means a change of role rather than editing individual permissions. Discretionary access control is the tempting choice, but there each resource's owner decides who may use it, while mandatory access control relies on system-enforced classification labels.
Key insight: In role-based access control, permissions follow the job.
Question 5Advanced
An application's audit log shows that a customer-service account, which normally opens about 20 customer records a day, exported 48,000 customer records between 1:00 and 1:10 a.m. What does this most likely indicate?
1. AData theft through a stolen or misused account
2. BA scheduled nightly backup run by the application
3. CA denial-of-service attack against the database
4. DA SQL injection attempt the application blocked
Show answer
Answer: A. Data theft through a stolen or misused account
A sudden, enormous jump above an account's normal volume at an unusual hour is a classic sign of data exfiltration, either by an attacker using the account or by a malicious insider. A nightly backup is the tempting explanation, but backups run under a dedicated service account on a schedule, not under an individual customer-service login.
Key insight: Compare activity to the account's baseline; a huge spike at an odd hour is an alarm.

Continue through AP Cybersecurity

Practice Applications and Data deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Unit 5: Securing Applications and Data