AP Cybersecurity 2.2 Exercise 1: Physical Attacks and How Threats Exploit Them

Unit 2 • 2.2 • Exercise 1

Home›AP Cybersecurity›Unit 2 › 2.2 › Exercise 1

Exercise 1 — Physical Attacks and How Threats Exploit Them

6 questions — Name the attack, separate the vulnerability from the threat, and trace the compromise

Score: 0 / 0 Predict the answer before selecting an option

Scenario Organization

Xtensr Research Labs — Scenario 2A

Xtensr Research Labs has acquired a smaller research company across town, and you are on the physical security team running the assessment of the new building. This exercise works through the walkthrough notes: name each physical attack correctly, separate the vulnerability from the threat, and state the compromise that would follow.

Q1 Spot the Error

A first-year analyst writes this finding for the assessment: “Employees at the new lab often chat with the front guard while badging in, so an adversary could stand behind them and enter unnoticed. This is card cloning, and the fix is to replace the badge readers with keypads.” Which statement identifies the errors in the finding?

(A) The finding is right on both counts: the attack is card cloning and keypads are the correct fix (B) The attack should be named shoulder surfing, and the fix should be privacy screen filters at the entrance (C) The attack should be named tailgating, and the fix should be a control that stops a second person entering on one authorization (D) The attack should be named dumpster diving, and the fix should be locked shredding bins in the lobby

There are two errors. The behavior described is tailgating (EK 2.2.A.3) — an adversary gains access by following close behind an authorized individual without that individual’s awareness. Card cloning (EK 2.2.A.6) is making a copy of an authorized user’s access card, which is not happening here. The recommended fix is also wrong: a keypad still authorizes one entry, and a distracted employee still lets a second person through. An access control vestibule or turnstile is the control that prevents one authorization from admitting two people (EK 2.3.B.5).

(A) Incorrect — the attack is misnamed, and keypads do nothing about a second person walking in on someone else’s authorization.

(B) Incorrect — shoulder surfing (EK 2.2.A.4) is watching a user access sensitive information so it can be used later; nothing is observed and reused here.

(D) Incorrect — dumpster diving (EK 2.2.A.5) is searching a target’s physical trash; the finding involves no discarded material.

Exam Tip: Re-derive the attack name from the behavior described, then check that the recommended control actually blocks that behavior. A wrong name almost always drags a wrong control with it.

Q2 Piggybacking Tactics

Three incidents are logged at the new lab’s rear entrance. Decide your own answer first: which incidents are examples of piggybacking?
I. A person balancing two boxes of copier paper waits by the door until an employee opens it and holds it for them.
II. A person in a utility uniform tells an employee they need to inspect the sprinkler riser and is walked inside without a work order.
III. A person moves quickly and silently through the door as it swings shut behind a departing employee who never looks back.

(A) I only (B) I and II only (C) II and III only (D) I, II, and III

Piggybacking is when an adversary uses social engineering to manipulate an authorized individual into granting access to a restricted area (EK 2.2.A.2), and the framework names these tactics directly: carrying something large so an authorized person holds the door, claiming to have forgotten an access token, and posing as maintenance staff who need to inspect or repair something. Incidents I and II are those two tactics. Incident III is tailgating (EK 2.2.A.3) — the departing employee never becomes aware, so nothing was granted.

(A) Incomplete — incident II is the maintenance-worker piggybacking tactic named in EK 2.2.A.2, so it belongs with incident I.

(C) Incorrect — incident III is tailgating rather than piggybacking, and incident I is a piggybacking tactic that this option leaves out.

(D) Incorrect — incident III involves no awareness or decision by the departing employee, which places it under tailgating.

Exam Tip: Every piggybacking tactic in the framework needs a human to say yes. If nobody in the story decides to help, you are looking at tailgating.

Q3 Attack Recognition

An adversary spends a week studying the new lab. Each observation below describes one of the physical attacks named in Topic 2.2 EXCEPT one. Which observation does not describe a Topic 2.2 physical attack?

(A) Photographing an analyst’s screen from a café patio while she reviews participant files (B) Recovering an internal org chart and a vendor invoice from the unlocked paper recycling bin (C) Reading a badge number off a lanyard through a long lens and encoding it onto a blank card (D) Mailing the lab’s operations manager a fake renewal notice from a spoofed vendor address

Option A is shoulder surfing, including the camera variant EK 2.2.A.4 calls out. Option B is dumpster diving (EK 2.2.A.5). Option C is card cloning (EK 2.2.A.6) — copying an authorized user’s access card so the adversary inherits everything that user can reach. Option D is a pretexting attack delivered remotely: real, but a Topic 2.1 social engineering attack rather than a physical one. Social engineering often supports a physical attack (EK 2.2.A.1); the test is whether the adversary is acting on the physical space or on a physical object.

(A) This is shoulder surfing — EK 2.2.A.4 explicitly includes recording the target with a camera for later analysis.

(B) This is dumpster diving — going through a target’s physical trash for information that advances the adversary’s goal.

(C) This is card cloning — producing a copy of an authorized user’s access card in order to use that user’s access.

Exam Tip: A Topic 2.2 attack requires the adversary to act on a physical space or a physical object. If the whole attack could run from another country, it belongs in Topic 2.1.

Q4 Device Exploitation

The new lab’s conference room holds a wall-mounted PC that stays logged into a shared scheduling account, and its USB ports are enabled and within reach. Which statement BEST explains why the assessor rates this a serious vulnerability rather than a minor inconvenience?

(A) An adversary with a few unobserved minutes can attach a keylogger or a malware-loaded drive and take control of the device (B) Anyone in the room can read the shared scheduling calendar, which reveals when the lab’s rooms sit empty (C) Shared accounts make it impossible to prove which employee scheduled which meeting on which day (D) A permanently logged-in machine holds an active license that the lab could reassign to a research workstation

When adversaries gain physical access to a device and its ports, they can plug in a keylogger or an external drive containing malware, which can collect data from a user or possibly give the adversary control of the device (EK 2.2.B.5). That is a compromise of the device itself, not merely an information leak, and physical access to devices lets adversaries bypass many technical controls and layers of security (EK 2.2.C.1). Disabling USB ports is the matching control (EK 2.3.B.6).

(B) Incorrect — occupancy patterns are useful reconnaissance for an adversary, but they do not amount to device compromise.

(C) Incorrect — weak accountability is a real drawback of shared accounts, yet it does not explain the severity of reachable ports.

(D) Incorrect — license allocation is a cost question and does not belong in a vulnerability finding at all.

Exam Tip: For a physical finding, ask what the adversary can do with the access, not only what they can see. Port access escalates to control of the device, which outranks disclosure.

Q5 Vulnerability vs Threat

The assessment has to separate the vulnerability from the threat in every finding. For the finding “the loading-dock door latch is broken and the door rests unlatched overnight,” which pairing is correct?

(A) The vulnerability is theft of the equipment inside; the threat is the broken door latch (B) The vulnerability is the overnight hours; the threat is the loading dock sitting behind the building (C) The vulnerability is the value of the equipment inside; the threat is the missing camera on the dock (D) The vulnerability is the broken door latch; the threat is an adversary or event that could exploit it to enter and take or damage assets

A vulnerability is a weakness or flaw that could allow an asset to be compromised (EK 2.2.B.2), which is the broken latch. A threat is what could act on that weakness — human adversaries seeking harm or disruption, and natural events as well (EK 2.2.B.1). Keeping the two apart is what lets you state the compromise cleanly: unauthorized access to a restricted physical space, followed by theft or destruction of resources.

(A) Incorrect — this reverses the pair. Theft is the compromise that results, and the latch is the weakness rather than the actor.

(B) Incorrect — the hours and the location both affect likelihood, but neither is the flaw itself nor the party acting on it.

(C) Incorrect — asset value drives impact, and a missing camera is a second vulnerability, not the threat.

Exam Tip: Vulnerability is the flaw. Threat is who or what acts on it. Compromise is what happens as a result. Mixing the three is the fastest way to lose points on a documented risk.

Q6 Availability Impact

The new lab’s electrical box sits in an unlocked exterior alcove, and the badge readers, cameras, and specimen freezers all draw from it with no backup power. Which consequence should the assessment document as the MOST direct result of an adversary opening that box and pulling the main breaker?

(A) Stored specimen data becomes readable to the adversary because the drives power down mid-write (B) The badge reader database is silently modified so that unauthorized cards are accepted afterward (C) The lab’s devices and the services they provide become unavailable, and every control that depends on that power stops working (D) The adversary receives a copy of the camera footage that was recorded before the outage

When adversaries disrupt power to a device, the device and any services it provides become unavailable (EK 2.2.B.3), and damaging fuses or breakers is one of the named ways to do it. What makes this finding worse than a simple outage is that the detection and access controls run on the same power, so one physical act removes several layers at once. An uninterruptible power supply or a generator is the matching control (EK 2.3.B.7).

(A) Incorrect — cutting power does not make stored data readable; this confuses an availability compromise with a confidentiality one.

(B) Incorrect — modifying the reader database is an unauthorized-modification compromise and requires access to the system, not to the breaker.

(D) Incorrect — an outage stops new footage from being recorded; it does not hand the adversary the footage already stored.

Exam Tip: Power findings map to availability. Name the compromise the framework names — the device and its services become unavailable — then check which other controls share that power source.

Questions Correct

Exercise 2 → Course Hub

← Lesson 2.2 Exercise 2 →

AP Cybersecurity Unit 2 • 2.2 • Exercise 1 | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 2 · Lesson 2.2 · Exercise 1

Lesson•Exercise 1•Exercise 2 →•Lab•Quiz

Back to:Lesson 2.2 Unit 2 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]