AP Cybersecurity Unit 2 Lesson 1 Exercise 1
Exercise 1 — Social Engineering Tactics & Adversary Types
6 questions — Name the tactic in the message and the adversary behind the incident (CED Topic 2.1, EK 2.1.A–B)
EK 2.1.A lists the tactics an adversary uses to manipulate a target — authority, urgency, scarcity, consensus, familiarity, intimidation, and pretexting. EK 2.1.B lists who is doing the manipulating — script kiddies, hacktivists, insider adversaries, cyberterrorists, and transnational criminal organizations.
Questions 1, 2 and 6 hand you a message and ask for the tactic. Questions 3 and 4 hand you an incident and ask for the adversary type. Question 5 asks you to find the one definition that is stated wrongly. Write your answer down before you read the choices: every distractor here is a real tactic or a real adversary type, so an option sounding plausible is not evidence that it is right.
(B) Incorrect — nothing in the message limits the supply of a resource (scarcity) or claims that other employees have already complied (consensus).
(C) Incorrect — the sender never claims a personal relationship with the target (familiarity), and an audit flag on the quarterly close is a business consequence, not a threat of harm to the target (intimidation).
(D) Incorrect — “Dana in the CFO’s office” is a pretext, so half of this pair is defensible, but the message makes no appeal to what other people are doing.
(A) Incorrect — scarcity restricts a resource (“only three seats left”). Here the portal is open to the whole team; what is limited is social cover, not supply.
(C) Incorrect — urgency names a cutoff and a consequence for missing it. “Last week” describes the past and sets no deadline.
(D) Incorrect — authority requires the sender to hold or borrow power over the target. A comparison to peers carries no power.
(A) Incorrect — script kiddies run tools developed by others and do not start with authorized access to the target.
(B) Incorrect — a hacktivist acts to advance a cause. Selling the files for personal profit is not a cause.
(D) Incorrect — cyberterrorists target civil infrastructure to disrupt communities, regions, or nations, not one employer’s design files.
(A) Incorrect — hacktivists pursue a cause, and “purely for money” rules a cause out.
(B) Incorrect — a coordinated multi-site ransomware and resale operation is beyond the capability of an adversary running someone else’s tools, and the motive named is revenue, not recognition.
(C) Incorrect — cyberterrorists are defined by political or ideological motive. The target fits; the motive does not.
(A) Not the error — this is an accurate description of script kiddies (EK 2.1.B.1).
(B) Not the error — this is an accurate description of hacktivists (EK 2.1.B.2).
(D) Not the error — insiders can be recruited by outside parties, which is why access reviews matter (EK 2.1.B.3).
I. “Only three license seats are left for the free upgrade — claim yours before they run out.” — scarcity
II. “I’m calling from your bank’s fraud desk; I just need to verify the code we texted you.” — pretexting
III. “Your manager told me to have you reset the shared password today.” — consensus
Which pairings are correct?
(A) Incorrect — I is right, but a caller inventing a fraud-desk identity is a textbook pretext, so II belongs in the answer.
(C) Incorrect — III is mislabeled. Nothing in it claims that anyone else has already complied.
(D) Incorrect — II is right, but III is authority rather than consensus, so the pair fails.
AP® is a registered trademark of the College Board, which was not involved in the production of this content.
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]