AP CSP 5.6 Safe Computing | PII, Encryption, and Authentication
Safe Computing
After this lesson, you will be able to:
- Define personally identifiable information (PII) and explain the risks of sharing it online
- Recognize the signs of a phishing message and describe how malware and social engineering attacks work
- Explain how strong unique passwords and multifactor authentication protect an account
- Describe what encryption does and distinguish symmetric encryption from public key encryption
- Choose appropriate safe computing practices for a given scenario
You get a text that looks like it is from your bank: it warns your account is locked and gives a link to 'verify your identity' by entering your password and Social Security number right now. The logo looks real and the message sounds urgent. Before you tap anything, what is the single biggest clue that this message might be a trap, and what should you do instead?
Personally Identifiable Information (PII)
Personally identifiable information (PII) is information that can be used to identify a specific individual, either on its own or combined with other data. Examples include your full name, home address, government identification number, phone number, email address, date of birth, biometric data such as a fingerprint or face scan, and your physical location.
The core risk is simple: once information is online, it is very hard to remove and easy to copy. PII that gets exposed can be exploited for identity theft, used to track your movements and habits, or combined with other leaked data to launch targeted attacks. Even seemingly harmless details can be pieced together. Sharing less PII, and thinking before you post, reduces how much of you is exposed.
When a question asks about the danger of sharing PII, the strongest answer names a concrete harm such as identity theft, tracking, or targeted attacks, and recognizes that information online is hard to remove and easy to copy. Answers about convenience or speed are distractors.
Threats: Phishing, Malware, and Social Engineering
Most attacks on ordinary users do not break encryption. They trick the user.
- Phishing is a fraudulent message, often an email or text, designed to trick you into revealing credentials or PII, or into clicking a malicious link. Phishing usually creates urgency ("act now or lose access"), impersonates a trusted source, and sends you to a fake page that harvests what you type.
- Malware is malicious software, such as a virus, that is installed without your informed consent to damage a system, steal data, or take control of a device.
- Social engineering is the broad category of manipulating people into giving up information or access. Phishing is one kind of social engineering.
The common thread is that the human is the target. Signs of phishing include unexpected requests for a password or PII, links whose real address does not match the sender, pressure to act immediately, and small errors in the sender address or spelling.
Protections: Passwords and Multifactor Authentication
Your first defense is a strong, unique password: long, hard to guess, and different for every account so that one breach does not unlock the rest. But passwords alone can be stolen or phished, which is why the strongest protection adds more factors.
Multifactor authentication (MFA) requires proof from two or more different kinds of factors before granting access. The three categories are:
| Factor type | Meaning | Example |
|---|---|---|
| Something you know | Information only you should have | Password or PIN |
| Something you have | A physical item or device | Phone receiving a code, or a security key |
| Something you are | A biometric trait | Fingerprint or face scan |
The power of MFA is that an attacker who phishes your password still cannot log in without the second factor, such as the code on your phone. Other everyday protections include being cautious with links and app permissions, and keeping software updated so known vulnerabilities are patched.
Requiring two passwords, or a password plus a security question, is NOT multifactor authentication. Both are "something you know," so they are the same kind of factor. True multifactor combines different kinds of factors, such as a password (know) plus a code from your phone (have).
Encryption: Symmetric and Public Key
Encryption encodes data so that only authorized parties can read it. The scrambled data means nothing to an eavesdropper without the correct key. There are two schemes you must distinguish:
| Symmetric encryption | Public key (asymmetric) encryption | |
|---|---|---|
| Keys used | One shared key | A pair: a public key and a private key |
| How it works | The same key both encrypts and decrypts | The public key encrypts; only the matching private key decrypts |
| Key sharing | Both parties must already share the secret key | The public key can be shared openly; no secret must be exchanged first |
The key advantage of public key encryption is that two people who have never met can communicate securely. You publish your public key for anyone to use to encrypt a message to you, but you keep your private key secret, and only it can decrypt those messages. Symmetric encryption is fast but requires a way to share the one secret key safely in advance.
How 5.6 Is Tested on the MCQ Exam
Safe computing appears on the multiple-choice section in a few predictable shapes. Expect a phishing scenario that describes a suspicious message and asks you to identify the warning sign or the safe response; the right answer names the mismatched link, the urgent request for credentials, or the choice to not click and to verify through a known channel. Expect a PII question that asks which item is personally identifiable or names the risk of sharing it, where the strong answer cites identity theft, tracking, or targeted attacks and the difficulty of removing information once it is online.
Expect a multifactor authentication item that tests whether you understand factors must be of different kinds (know, have, are), so two passwords do not count. And expect an encryption item that checks the difference between symmetric encryption (one shared key for both directions) and public key encryption (a public key encrypts, a private key decrypts, no shared secret needed first). Precise vocabulary is what earns these points, so learn the exact definitions rather than the general vibe.
Get a free AP CSP question every day
Join 3,000+ students. Daily practice, study tips, and exam strategies.
A student receives an email that appears to be from their school's login system. It says their account will be deleted in one hour unless they confirm their password by clicking a link, and the link's real address is a string of random characters unrelated to the school. Which feature most strongly indicates this is a phishing attempt?
Two people who have never communicated before want to exchange a secret message over the internet without first meeting to agree on a shared secret. Which approach makes this possible, and why?
Consider the following pieces of information:
- I. A person's government-issued identification number
- II. A person's home address combined with their full name
- III. The current outdoor temperature in a large city
A website wants to add multifactor authentication. Which change actually implements multifactor authentication?
A user posts a photo online that automatically includes location data, along with their full name and daily schedule. Which outcome best describes the primary risk created by sharing this personally identifiable information?
An employee receives an unexpected message claiming to be from their company's help desk, asking them to reply with their username and password to 'complete a required security update.' What is the safest response?
🐛 Phishing Net
Spot phishing and lock down accounts - AP CSP 5.6 Safe Computing.
How to play: Messages stream in. Tap PHISH or SAFE fast, then ace the Secure-the-Account bonus round.
Frequently Asked Questions
🔗 Continue studying
Safe computing lands best when students test it on themselves: have them audit their own accounts for reused passwords, turn on multifactor authentication somewhere real, and dissect an actual phishing email line by line. The Superpack includes a phishing-spotting worksheet, an encryption compare-and-contrast chart, and a PII scavenger hunt. View what's included →
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]