Foundations of cybersecurity — threats, defenses, cryptography, and secure system design.
Study guide last reviewed September 25, 2026 · see what changed
Format reflects the current published structure — always confirm against AP Central before test day, since formats occasionally change.
| Section | Details | Time | Weight |
|---|---|---|---|
| Section I – Multiple Choice | 60 questions (individual items and 2–4 question sets, analyzing scenarios & digital evidence) | 80 min | 70% |
| Section II – Free Response | 1 question: evaluate firewall rules, system logs, file permissions & device policies from a single device | 50 min | 30% |
Straight answers about the AP Cybersecurity exam — format, credit, dates, and this site.
Section I – Multiple Choice: 60 questions (individual items and 2–4 question sets, analyzing scenarios & digital evidence) (80 min, 70% of the total score); Section II – Free Response: 1 question: evaluate firewall rules, system logs, file permissions & device policies from a single device (50 min, 30% of the total score). See the Exam Format tab above for the full breakdown, and always double-check the current year's format on AP Central before test day.
It's multiple-choice questions and written free-response or essay questions.
It depends entirely on the college — most award credit for a 3 or higher, but many selective schools require a 4 or a 5, and some don't grant credit at all for certain scores. Always check your target college's own AP credit policy page rather than assuming a 3 will count everywhere.
AP exams are administered during the College Board's annual testing window in the first two full weeks of May, with the exact date and time for each subject set by the College Board and announced the preceding fall. Check AP Central or your school's AP coordinator for this year's exact date.
Yes. The unit-by-unit study guide, worked examples, practice quiz, and full-length timed practice exam on this page are all free, with no login, signup, or paywall.
Unit-by-unit breakdown of what the course actually covers, in teaching order.
Network fundamentals (IP addressing, routing, the client-server model) and internet protocols (TCP/IP, HTTP/HTTPS) providing the technical vocabulary necessary to understand how and where security vulnerabilities arise.
Specific attack categories with their distinguishing mechanisms: phishing/social engineering (exploiting human trust), malware types (viruses, worms, ransomware, trojans), and network-based attacks (DDoS, man-in-the-middle) — each requiring a different defensive approach.
Symmetric versus asymmetric encryption and when each is used, hashing for data integrity verification (versus encryption for confidentiality), and authentication methods (passwords, multi-factor authentication, biometrics) and their relative strength.
Firewalls' rule-based traffic filtering, access control models (principle of least privilege), and network segmentation as a defense-in-depth strategy limiting how far an attacker can move after an initial breach.
The privacy-security tradeoff in policy debates (surveillance, encryption backdoors), and cybersecurity's real-world economic and social stakes illustrated through the consequences of specific, named types of breaches.
Concrete, fully worked examples — this is what separates a page reviewers see as genuinely useful from one that just lists topics.
Trace a web request: what actually happens when you type a URL and hit enter?
DNS resolves the domain name to an IP address → your device opens a TCP connection to that IP (the three-way handshake) → the browser sends an HTTP(S) request. For HTTPS specifically, a TLS handshake negotiates an encrypted session before any actual page data is exchanged — knowing where encryption enters this sequence is a frequently tested detail.
Match the defense to the attack: phishing versus a DDoS attack.
Phishing exploits human trust (a fake email tricking someone into revealing credentials) — the defense is user training and email filtering. A DDoS attack floods a server with traffic from many sources to deny service to real users — the defense is traffic filtering and rate limiting. These require completely different defenses because they exploit completely different weaknesses (people vs. infrastructure capacity).
Symmetric vs. asymmetric encryption: why does HTTPS use both?
Symmetric encryption (like AES) uses one shared key for both encryption and decryption — fast, but requires securely sharing that key first. Asymmetric encryption (like RSA) uses a public key to encrypt and a private key to decrypt, solving the key-distribution problem but running much slower. HTTPS uses asymmetric encryption briefly to securely exchange a symmetric key, then switches to fast symmetric encryption for the rest of the session — getting both security and speed.
Principle of least privilege: why shouldn't a marketing employee's account have access to the finance database?
If that account is compromised via phishing, least privilege limits the blast radius — the attacker only inherits whatever limited permissions that employee actually had. Without least privilege, a single compromised low-level account could expose systems far beyond what that employee's job ever required.
The encryption backdoor debate: represent both sides fairly.
Law enforcement argues backdoors help investigate crime and terrorism by giving authorized access when needed. Security experts counter that any backdoor is itself a vulnerability — one that can eventually be discovered and exploited by attackers too, weakening security for everyone, not just the criminals it was meant to target. FRQs on policy tradeoffs expect both perspectives represented, not just one.
The errors that cost the most points across the whole exam, not just one unit.
Unofficial practice questions written for this study guide — not official AP content and not from College Board. Use them to self-check, then use the real past free-response questions below for authentic exam practice.
Unofficial practice, timed to feel like the real thing. Section I pulls from this page's full multiple-choice bank; Section II gives you free-response prompts to write out and self-score against a rubric. Bank size is still growing toward full exam length — timing is paced per-question, not pulled from this subject's official duration.