AP CSP Topic 5.6: Safe Computing | Big Idea 5 | APCSExamPrep.com

Define PII and identify examples of personally identifiable information
Explain how disparate data sources can be aggregated to reveal private information
Describe authentication methods including strong passwords and multifactor authentication
Explain how symmetric and public key encryption protect data
Identify common attack methods: phishing, keylogging, rogue access points, and malware

📈 Exam Weight: 21-26% (BI5 combined)

📝 CED Standards: IOC-2.A, IOC-2.B, IOC-2.C

✅ 5 MCQs • 5 FAQs

💡

Exam Impact: Safe Computing is the most fact-dense BI5 topic with 3-5 MCQ questions per exam. The vocabulary is heavy: PII, multifactor authentication, symmetric encryption, public key encryption, phishing, keylogging, rogue access point. Every term is directly tested.

Why This Matters

Your name alone reveals little. Your employer alone reveals little. Your neighborhood alone reveals little. But your name + employer + neighborhood + browsing history + location data + purchase history together create a detailed profile that can be used to stalk you, steal your identity, manipulate your decisions, or deny you services. The AP exam tests whether you understand how individually harmless data becomes dangerous when aggregated.

Personally Identifiable Information (PII)

PII is information about an individual that identifies, links, relates, or describes them. The AP exam expects you to recognize PII from examples:

Social Security number
Age, race, biometric data
Phone numbers
Medical and financial information
Location data

PII can be used to enhance user experiences (personalized recommendations, simplified purchases) and also to harm users (identity theft, stalking, discrimination).

Data aggregation trap: The AP exam frequently tests this: disparate data that is NOT individually PII can be combined to create PII. Your favorite coffee shop location alone is harmless. Your home neighborhood alone is harmless. Your gym schedule alone is harmless. Combined: anyone can predict exactly where you are at specific times. The CED specifically cites geolocation, cookies, and browsing history as examples of aggregatable data.

Privacy Risks of Data Collection

The Internet is built on data collection. Every interaction leaves traces:

Search engines record and maintain search history; use it for targeted advertising
Websites record which pages you visit and when
Devices and apps collect location data -- where you've been, how you got there, how long you stayed
Social media posts can be viewed by employers, law enforcement, and others you didn't intend
Online purchases create records that can be used to infer health, relationships, and finances

Critical point: “Once information is placed online, it is difficult to delete.” Even deleted posts can persist in screenshots, archive sites, and backups.

Authentication: Protecting Access

Authentication measures protect devices and information from unauthorized access.

Strong passwords:

Easy for the user to remember
Difficult for others to guess based on knowledge of the user
The AP exam won't test specific password rules, but the CED definition emphasizes the difficulty-for-others criterion

Multifactor authentication (MFA) requires at least two separate forms of evidence from different categories:

Knowledge -- something you know (password, PIN)
Possession -- something you have (phone, hardware token, smart card)
Inherence -- something you are (fingerprint, face, retina scan)

Key AP exam point: MFA requires at least TWO steps from at least TWO different categories. Two passwords would be two knowledge factors -- that is NOT multifactor authentication in the CED definition. You need two different categories.

Encryption

Encryption encodes data to prevent unauthorized access. Decryption decodes it back. The AP exam tests two types:

Type	How It Works	Key Property
Symmetric key	Same key encrypts AND decrypts	Both parties need the same secret key -- key distribution is the challenge
Public key (asymmetric)	Public key encrypts; private key decrypts	Sender uses recipient's PUBLIC key; only recipient's PRIVATE key decrypts it

Public key encryption insight: Anyone can encrypt a message to you using your public key (it's public -- share it widely). Only YOU can decrypt it because only you have your private key. The sender never needs your private key. This is how HTTPS works.

Certificate authorities issue digital certificates that validate ownership of public encryption keys -- they're the trusted third party that confirms a website's public key actually belongs to that website.

Attack Methods: How Unauthorized Access Is Gained

The AP exam directly tests these attack vectors by name:

Attack	Method	Defense
Phishing	Tricks users into providing personal information via fake emails, websites, or messages	Verify sender identity; don't click unsolicited links
Keylogging	Program records every keystroke to capture passwords and other confidential info	Anti-malware software; avoid untrusted software
Rogue access point	Fake Wi-Fi hotspot that intercepts, analyzes, and modifies data sent over it	Use VPN; verify network authenticity; avoid public Wi-Fi for sensitive data
Malware	Software designed to damage a system or take partial control	Anti-malware; software updates; don't download untrusted software
Computer virus	Malicious program that copies itself and attaches to legitimate programs	Anti-virus software; regular updates

AP exam vocabulary check: Know these terms cold. A rogue access point is specifically about unauthorized Wi-Fi -- not about a compromised router on a home network. Keylogging is specifically about recording keystrokes -- not about reading stored files.

Practice MCQs

Predict your answer before clicking. These questions match AP exam difficulty and phrasing.

🔎 MCQ 1 of 5

A user's name, employer, and zip code are each publicly available individually. When combined, this data can be used to uniquely identify most individuals. This scenario BEST illustrates: