AP Cybersecurity Unit 2 Lesson 2 Exercise 1

Unit 2 • 2.2 • Exercise 1

Home›AP Cybersecurity›Unit 2 › 2.2 › Exercise 1

Exercise 1 — Defense-in-Depth Layer Analysis

6 questions — Evaluate layered security architectures and identify weaknesses

Score: 0 / 0 Predict the answer before selecting an option

Client Organization

Sycamore School District

Sycamore School District is implementing a defense-in-depth strategy to protect student data across 8 schools. The current security posture relies almost entirely on a single perimeter firewall. The CISO wants to add multiple overlapping layers so that no single failure leaves the district exposed.

Q1 Core Concept

Sycamore currently relies on a single perimeter firewall as its only security control. If this firewall is bypassed (through a zero-day exploit, misconfiguration, or insider access), the attacker has unrestricted access to all district systems. This architecture violates the defense-in-depth principle because:

(A) The firewall is outdated and should be replaced with a newer model that cannot be bypassed (B) A single security control creates a single point of failure — when it fails, there are no additional layers to detect, slow, or stop the attacker (C) Firewalls are not effective security tools and should be replaced entirely with antivirus software (D) The firewall should be moved from the perimeter to inside the network, closer to the servers it protects

Defense-in-depth requires multiple, overlapping security layers. When only one control exists (the perimeter firewall), its failure is catastrophic — there is nothing else to catch what it misses. Layered security ensures an attacker must defeat multiple independent controls to succeed.

(A) Incorrect — no security device is immune to bypass; the issue is relying on a single layer, not the device’s age.

(C) Incorrect — firewalls are essential; the problem is relying on one alone without additional layers.

(D) Incorrect — moving the firewall’s location does not add defense-in-depth; it just changes where the single point of failure sits.

Exam Tip: Defense-in-depth = multiple layers. If you can describe an organization’s entire security as “we have a [single thing]”, it violates this principle.

Q2 Layer Identification

The CISO proposes the following security layers for the district:

Layer 1: Perimeter firewall
Layer 2: Network segmentation (VLANs separating student, staff, and admin networks)
Layer 3: Endpoint antivirus on all devices
Layer 4: Multi-factor authentication for all staff accounts
Layer 5: Encrypted backups stored offsite

Which of the following statements about this architecture are correct?

I. If the firewall is bypassed, VLANs still limit the attacker’s lateral movement within the network.
II. If malware evades the firewall and network segmentation, endpoint antivirus provides a third chance to detect it.
III. Encrypted offsite backups ensure the district can recover even if ransomware encrypts all on-site systems.

(A) I only (B) I and II only (C) II and III only (D) I, II, and III

All three statements are correct and illustrate how each layer provides independent protection: VLANs contain lateral movement (I), endpoint AV catches what network controls miss (II), and offsite backups enable recovery after a total compromise (III). This is the essence of defense-in-depth — each layer compensates for the potential failure of others.

(A) Incomplete — Statements II and III are also correct.

(B) Incomplete — Statement III is also correct.

(C) Incomplete — Statement I is also correct.

Exam Tip: Defense-in-depth layers should be INDEPENDENT — each one works even if the others fail. The strength of the strategy comes from redundancy, not from any single layer.

Q3 Layer Types

Which of the following is NOT an example of a defense-in-depth layer?

(A) Physical security: badge readers on server room doors that restrict entry to authorized IT staff (B) Administrative controls: a security policy requiring all staff to complete annual cybersecurity awareness training (C) Technical controls: an intrusion detection system that monitors network traffic for suspicious patterns (D) Optimistic security: assuming that attackers will not target a school district because educational data has low value

Defense-in-depth includes physical controls (locks, badges), administrative controls (policies, training), and technical controls (firewalls, IDS, encryption). Assuming you will not be attacked is not a security layer — it is the absence of security. Educational data (student records, SSNs, financial aid) is actually high-value to attackers.

(A) Valid layer — physical security is the outermost defense-in-depth layer.

(B) Valid layer — administrative controls (policies, training) are a recognized defense-in-depth category.

(C) Valid layer — IDS is a technical security control that adds detection capability.

Exam Tip: Three categories of defense-in-depth controls: Physical (locks, fences, cameras), Administrative (policies, training, procedures), Technical (firewalls, encryption, access controls).

Q4 Failure Analysis

A phishing email bypasses Sycamore’s email gateway filter and reaches a teacher’s inbox. The teacher clicks the malicious link. In a well-designed defense-in-depth architecture, which layers could STILL prevent a successful compromise after this point?

I. The teacher’s security awareness training causes them to recognize the suspicious login page and close it before entering credentials.
II. The endpoint browser isolation tool opens the link in a sandboxed container, preventing the malicious site from accessing the teacher’s real credentials.
III. Even if credentials are stolen, MFA prevents the attacker from logging in without the teacher’s second authentication factor.

(A) I only (B) III only (C) I and III only (D) I, II, and III

All three are valid defense-in-depth layers that activate after the email filter fails: training (administrative control) may prevent credential entry, browser isolation (technical control) can sandbox the malicious site, and MFA (technical control) blocks login even with stolen credentials. Each layer operates independently.

(A) Incomplete — technical controls (II and III) also provide post-click protection.

(B) Incomplete — training and browser isolation also contribute.

(C) Incomplete — browser isolation (II) is also a valid layer.

Exam Tip: Defense-in-depth means multiple chances to stop an attack at different stages. Even after a user clicks a phishing link, several layers can still prevent compromise.

Q5 Redundancy vs Diversity

Sycamore deploys two identical firewalls from the same vendor in a high-availability pair. If one fails, the other takes over. A zero-day vulnerability is discovered in this firewall model that allows bypass. What is the limitation of this approach compared to true defense-in-depth?

(A) Two firewalls cost more than one, making this an inefficient use of budget without adding security value (B) Identical devices share the same vulnerabilities — a flaw that bypasses one will bypass both, providing redundancy for hardware failure but not for security bypass (C) Running two firewalls simultaneously creates network conflicts that slow down all traffic (D) The second firewall is unnecessary because modern firewalls never experience hardware failures

Redundancy (two identical devices) protects against hardware failure but not against security flaws. A zero-day that bypasses Firewall A will also bypass Firewall B because they run the same software. True defense-in-depth uses DIVERSE controls — different technologies at different layers — so a vulnerability in one does not compromise all.

(A) Incorrect — HA pairs do add availability value; the limitation is specifically about security diversity, not cost.

(C) Incorrect — HA pairs are designed to avoid conflicts; one is active while the other is standby.

(D) Incorrect — all hardware can fail; HA pairs exist specifically because failures occur.

Exam Tip: Redundancy ≠ defense-in-depth. Redundancy protects against failure of the SAME control. Defense-in-depth protects against bypass of ANY SINGLE control through diverse, layered alternatives.

Q6 Applied Design

The district’s student information system (SIS) contains FERPA-protected student records. Which defense-in-depth design provides the MOST comprehensive protection for this system?

(A) A single next-generation firewall with every available security feature enabled, providing all protection from one device (B) Multiple independent layers: network segmentation isolating the SIS, access controls limiting who can reach it, encryption of data at rest and in transit, audit logging of all access, and regular backup of the database (C) Physically disconnecting the SIS from the network entirely so it cannot be reached by any attacker (D) Purchasing cyber insurance to cover financial losses if the SIS is breached, eliminating the need for technical controls

Option B implements true defense-in-depth: segmentation (network layer), access controls (authentication layer), encryption (data layer), audit logging (detection layer), and backups (recovery layer). Each layer protects against a different type of failure or attack vector.

(A) Incorrect — a single device, no matter how advanced, is still a single point of failure. Defense-in-depth requires multiple independent controls.

(C) Incorrect — air-gapping the SIS makes it inaccessible to authorized users (teachers, administrators), destroying availability.

(D) Incorrect — insurance transfers financial risk but does not prevent breaches or protect student data. It is a risk management tool, not a security control.

Exam Tip: The best defense-in-depth answer always involves MULTIPLE layers at DIFFERENT levels (network, host, data, physical, administrative). A single “super device” is never the right answer.

Questions Correct

Exercise 2 → Course Hub

← Lesson 2.2 Exercise 2 →

AP Cybersecurity Unit 2 • 2.2 • Exercise 1 | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 2 · Lesson 2.2 · Exercise 1

Lesson•Exercise 1•Exercise 2 →•Lab•Quiz

Back to:Lesson 2.2 Unit 2 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]