AP Cybersecurity Unit 1 Lesson 3 Exercise 2
Exercise 2: Applied Wireless Security Analysis
Harder applied wireless security questions: HTTPS limitations, multi-stage attack chains, policy design, and I/II/III multi-correct AP exam format.
Each scenario involves a person at risk on a public Wi-Fi network. Identify which protection would have prevented the specific harm described.
Alex uses the airport’s free Wi-Fi (“Airport_WiFi_Free”) to check their bank account. An attacker running an evil twin nearby captures Alex’s banking credentials. The banking app uses HTTPS but Alex has no VPN active.
Why didn’t HTTPS alone protect Alex’s credentials in this scenario?
Which single control would have most reliably prevented credential theft even on the evil twin?
A journalist at a hotel investigates a political story. Someone in a van outside activates a jamming device for 3 hours during a critical research window. The journalist cannot access the internet or make calls. No data is stolen.
Which statement most accurately classifies the impact of this attack?
Against a sophisticated jamming attack, which countermeasure is most realistic for an individual journalist?
Note: both C and D are valid countermeasures — wired ethernet is unaffected by wireless jamming; cellular uses different frequency bands. The key point: jamming targets wireless frequencies, so switching medium defeats it.
A security team discovers that someone conducted extensive war driving near their company’s office building. Scans show the company’s internal wireless signal is detectable from the parking lot and the coffee shop across the street.
What immediate security risk does this finding create?
Two actions the company should take (select the most effective pairing):
The Vantex Financial Group security team is reviewing their remote work wireless policy after three employees reported suspicious Wi-Fi behavior at a co-working space.
Employee 1: Connected to “CoWork_Downtown_Free” and noticed unusual login activity on email 2 hours later
Employee 2: Connected to “CoWork_5G_Ultra” (same co-working space, network they didn't recognize) — no VPN active
Employee 3: Wi-Fi completely stopped working for 40 minutes; all other users at the space also affected
1. Match each incident to the most likely attack type (2 pts):
Employee 1 —
Employee 2 —
Employee 3 —
2. Vantex wants a single mandatory policy for all employees working from public spaces. Which policy covers all three attack types? (2 pts)
3. Employee 2 argues: ‘If I’m only browsing websites, not logging into anything, I don’t need VPN on public Wi-Fi.’ Identify the flaw in this reasoning. (2 pts)
The AP exam presents multi-part scenarios requiring you to distinguish between attack types, evaluate controls, and explain the reasoning. Answer these harder questions.
Question 1: An adversary first conducts war driving to find a coffee shop whose wireless signal extends to the street, then sets up an evil twin with the matching SSID from their car. Which statement BEST describes the relationship between the two attack types? (2 pts)
Question 2: A student at a public library connects to ‘LibraryFreeWiFi’ and notices their connection is very slow. Another student on the same network reports they cannot connect at all. Which attack BEST explains both observations simultaneously? (2 pts)
Question 3: I. Using VPN on public Wi-Fi protects against evil twin credential theft by encrypting traffic end-to-end. II. A VPN completely prevents a jamming attack from disrupting wireless connectivity. III. Confirming an SSID with venue staff before connecting reduces the risk of connecting to an evil twin. Which statements are TRUE? (2 pts)
AP exam wireless questions almost always give you a scenario and ask ONE of three things: (1) Name the attack type (evil twin=credential theft, jamming=DoS, war driving=reconnaissance). (2) Name what the attack does NOT do (jamming does NOT steal data; war driving does NOT yet compromise the network). (3) Name the control (VPN=data protection on public Wi-Fi; network segmentation=limits damage if connected; reducing signal power=reduces war driving intelligence). Know all three attack types, their limitations, and their specific defenses.
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]