How to Write the AP Cybersecurity FRQ, Paragraph by Paragraph

The AP Cybersecurity FRQ is the single free response question on the exam: a device security analysis you build from a scenario, not a definition you recall. Most students have been taught what security terms mean and never taught how to structure an answer under a timed clock. This is the paragraph by paragraph method, plus a full worked example, for writing an AP Cybersecurity FRQ that actually earns the reasoning marks.

Why the AP Cybersecurity FRQ is harder than it looks

Here is the thing nobody tells students about the AP Cybersecurity FRQ before they sit down to write one for the first time: it is not a knowledge test. You are handed a scenario, a device or a small system with some specific details attached, and asked to analyze its security posture and justify what you would do about it. There is no definition to recall that gets you full credit. There is no formula to plug numbers into. It is closer to writing a short structured argument than answering a quiz question, and almost nobody teaches students how to write structured arguments under exam conditions before their senior year of English, if then.

That gap matters more here than it would in most courses, because AP Cybersecurity does not currently have a bank of released free response questions for students to study from the way AP Computer Science A does. There is no decade of graded samples to look at and reverse engineer what the readers reward. Every practice scenario a student works through, including the ones in this guide, is an informed reconstruction from the course framework rather than a released item with real scoring notes attached. That makes structure the single highest leverage thing to teach, because structure is portable across scenarios in a way that memorized facts about any one device are not.

Students who study only vocabulary walk into this task knowing what confidentiality means and freezing anyway, because knowing what a term means and knowing how to apply it inside a four part argument, in fifty minutes, are different skills. The good news is that the second skill is teachable and drillable in a way the first one already is. That is what the rest of this guide is for.

The four paragraph structure to write under a 50 minute clock

Give yourself a structure you can rely on before you have even finished reading the prompt, so the fifty minutes go toward applying it rather than inventing one from scratch. Four paragraphs, in this order, each answering one question and only one question.

Paragraph 1: what is actually worth protecting here

Name the specific assets the scenario describes, not a generic list you memorized. A prompt about a point of sale system is not protecting "data" in the abstract. It is protecting customer card numbers during a transaction, the register's access to the store network, and maybe the owner's ability to process any sale at all if the system goes down. Vague answers here cost credit even when every word in them is technically true, because the task is asking you to read the scenario, not recite a category.

Paragraph 2: how an attacker would most plausibly reach it

Reason from the specific details in the prompt, not from a list of attack types you learned in Unit 3. If the scenario tells you the device connects over public guest wifi, that is your entry point, not a generic mention of network attacks in the abstract. If the scenario tells you an employee has admin rights they rarely use, that is your entry point instead. The scenario is giving you evidence on purpose. The strongest answers use nearly every specific detail the prompt hands you, and the weakest answers use none of them and describe a threat that could apply to any device anywhere.

Paragraph 3: the one control you would apply first, and why that one

Pick a single control and defend picking it over the alternatives you are not choosing. This is the paragraph where students often name three controls and hope one of them sticks. Do the opposite. Name one, and explicitly say why it addresses the specific attack path from paragraph two better than another control would. "I would apply multi factor authentication rather than a longer password policy, because the attack path here is a phished credential, and a longer password does nothing once the attacker already has the correct one" is a paragraph that earns credit. A list of four plausible controls with no ranking is a paragraph that does not.

Paragraph 4: what you gave up by applying it

Under time pressure, paragraph four is the first thing students cut, because paragraphs one through three feel like the "real" answer and four feels optional. It is not optional. It is frequently the paragraph that separates a response that names the right fix from a response that understands security. Budget for it on purpose, which the next section covers directly.

A full worked example: a school issued laptop

Structure is easier to hold onto with a full example in front of you, so here is one complete scenario and a full four paragraph response written to the structure above.

Sample response

What is worth protecting. The laptop holds more than the student's own schoolwork. Its browser stores saved login credentials, which likely include the student's school email and possibly personal accounts they logged into out of habit. During the fixed testing week each spring, it also temporarily caches secure testing content that the school is contractually obligated to keep confidential until the exam window closes. Beyond stored data, the laptop is a trusted, already authenticated device on the school network, so whoever controls it can reach whatever that network reaches, not just the files physically stored on the machine.

How an attacker would most plausibly reach it. The most realistic path here is not a remote hacking attempt, it is physical access to an unattended device. The laptop travels home on a bus daily and sits uncollected over weekends, which means it spends most of its life outside adult supervision. Combined with saved browser credentials and a fifteen minute lock window, a lost or briefly unattended laptop hands over an already logged in browser session to whoever picks it up, with no password required at all. The threat here is opportunistic physical access, not a sophisticated remote attacker, and the scenario is telling us that directly through the details about travel and storage.

The control I would apply first, and why. I would shorten the auto lock timeout to roughly two minutes and enforce full disk encryption through the existing device management profile, before adding anything else. I am choosing this over, for example, a stronger password policy, because the attack path identified above does not depend on guessing a password at all. It depends on physical access to a device that is already unlocked or whose contents are readable without the login screen ever being challenged. A short lock timeout closes the unattended session window, and disk encryption makes the stored data unreadable even if the device is removed entirely, which directly answers the specific way this laptop is exposed rather than a way it merely could be exposed in general.

What this control costs. A two minute timeout is a real usability cost for ninth graders who are still learning to manage their own devices, and it will generate a measurable rise in help desk tickets for forgotten passwords and re-logins during class, particularly in the first weeks after the change. Full disk encryption also adds a small but real performance cost on older hardware, which could matter during the timed state testing week specifically, the one week the scenario tells us the stakes are highest. A responsible rollout would test the performance impact on the oldest devices in the fleet before the testing window arrives, and pair the shorter timeout with staff training so students are not simply frustrated by it with no explanation. None of that erases the benefit, but it is a real cost, and naming it honestly is part of the analysis, not a footnote to it.

Time management for the 50 minute window

Fifty minutes disappears fast once you are actually writing, so budget it before the clock starts rather than while it is running.

1. First five to seven minutes, read and plan. Read the scenario twice. The first pass is for the story, the second pass is for underlining the specific details you will use in paragraphs one and two. Jot the control you plan to name in paragraph three before you write a single sentence of prose, so you are not still deciding while the clock runs.
2. Roughly ten minutes on paragraph one. Identify the assets, specifically, and stop. This is the paragraph students most often over-write, because it feels safe and concrete compared to the reasoning-heavy paragraphs that follow. A long, thorough asset list is not worth more than a focused one that names the two or three assets that actually matter to the scenario.
3. Roughly twelve minutes each on paragraphs two and three. This is where the scenario-specific reasoning lives, and it is worth protecting the time for it. Reference the prompt's own details rather than general knowledge, and pick one control rather than a list.
4. Protect at least ten minutes for paragraph four, no matter what. This is the instruction worth writing at the top of your scratch paper before the exam even starts. If time is short anywhere, shorten paragraph one, not paragraph four. A brief but honest trade-off paragraph earns more than a padded asset list and a rushed, one sentence afterthought about cost.
5. Final few minutes, reread against the four questions. Does each paragraph actually answer the question it is supposed to answer, or does it drift into repeating the paragraph before it? A fast check against the four part structure catches more lost credit than a grammar pass does.

One more thing worth knowing before you sit for the real exam: read our AP Cybersecurity course overview for how this single free response fits against the multiple choice section, since the two sections are not weighted the way most students first assume.

Two scenarios to practice on your own

The only way this structure becomes automatic is repetition, and repetition needs new scenarios, not the same one memorized twice. Work through both of these on your own paper, four paragraphs each, under a timer if you can manage it. No answer key follows on purpose. Writing your own response, cold, is the entire point of the drill.

If you want more scenarios built to the same shape as the exam, our AP Cybersecurity curriculum covers the unit content each scenario draws on, and the practice exam pairs multiple choice practice with the same free response method taught here.

Frequently asked questions

This guide is updated as College Board publishes further detail on the AP Cybersecurity free response and any released scoring guidance. Last reviewed August 18, 2026.