AP Cybersecurity Unit 2 Lesson 1 Quiz
Lesson 2.1 Quiz: Cyber Foundations
5 questions — Social engineering, adversaries, attack phases, risk, and controls
These five questions span the whole of Topic 2.1: social engineering tactics (2.1.A), types of adversaries (2.1.B), the phases of a cyberattack (2.1.C), the risk assessment process (2.1.D), strategies for managing risk (2.1.E), and types of security controls (2.1.F). Read each stem twice and predict your answer before you look at the choices — every distractor here is written to be plausible. Watch for the bolded keyword in the stem; it changes what the question is asking.
(A) Scarcity is correctly stated — the adversary manufactures the impression that an opportunity or resource is limited (EK 2.1.A.6).
(C) Familiarity is correctly stated — the adversary impersonates, or claims a relationship with, someone the target trusts (EK 2.1.A.7).
(D) Pretexting is correctly stated — the adversary invents a plausible reason for making contact (EK 2.1.A.2).
I. Installing a remote access trojan that re-launches at boot and beacons to a command and control server — persistence.
II. Using a harvested service account to reach a domain controller the adversary could not previously access — lateral movement.
III. Clearing the security event log and deleting the dropped malware binaries — taking action.
Which pairings are correct?
(A) Understates the report — II is also a correct pairing, so "I only" is too narrow.
(C) Accepts III, but wiping logs and deleting binaries is evading detection, not taking action.
(D) Accepts III and drops I, which was correctly labelled persistence.
(A) Perceived value of the target is one of the three named likelihood factors.
(B) Difficulty of exploitation is one of the three named likelihood factors.
(D) Adversary motivation and capability is one of the three named likelihood factors.
(B) No control was added to reduce likelihood, so this is not mitigation; the stated reason also describes acceptance, not avoidance.
(C) Acceptance means absorbing the residual risk without acting. The hospital did act — it bought a policy.
(D) The hospital did not stop using the vendor, so nothing was avoided; and transference is precisely what buying third-party insurance accomplishes.
(A) Correct as written — a badge reader is hardware protecting a physical space, and it stops unauthorized entry before it happens.
(B) Correct as written — encryption is implemented in software or hardware, and it keeps data unreadable to unauthorized parties (EK 2.1.F.1).
(C) Correct as written — an IDS is a technology, and it identifies attacks in progress rather than blocking them.
AP® is a registered trademark of the College Board, which was not involved in the production of this content.
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]