AP Cybersecurity 2.2 Quiz: Physical Vulnerabilities and Attacks

Unit 2 • 2.2 • Quiz

Home›AP Cybersecurity›Unit 2 › 2.2 › Quiz

Lesson 2.2 Quiz: Physical Vulnerabilities and Attacks

5 questions — Identify common physical attacks, explain how threats exploit them, and assess the risk they create

Score: 0 / 0 Answer each question, then check your score below

Scenario Organization

Xtensr Research Labs — Scenario 2A

You work on the physical security team at Xtensr Research Labs. Xtensr is acquiring a smaller research company in the same town, and you have been assigned the physical vulnerability assessment of the newly acquired lab: review the building plans and the controls already in place, identify physical vulnerabilities, and assess the likelihood and impact of each one.

Q1 Attack Identification

During the walkthrough of the newly acquired lab, an assessor watches a courier carrying a large equipment case stand beside the badge-controlled side entrance. An Xtensr technician badges in, sees the case, and holds the door open for the courier, who has no Xtensr badge. Which attack does this observation BEST illustrate?

(A) Tailgating, because the courier slipped into a restricted area directly behind an authorized employee (B) Piggybacking, because the courier used social engineering to get an authorized employee to grant the access (C) Shoulder surfing, because the courier watched an authorized employee present credentials at the entrance (D) Card cloning, because the courier entered using an access credential that had never been issued to them

Piggybacking and tailgating both end with an unauthorized person inside a restricted area, so the discriminator is consent. In piggybacking (EK 2.2.A.2) the adversary manipulates an authorized person into granting access, and carrying something bulky so that someone holds the door is the textbook tactic — alongside claiming to have forgotten a badge or posing as maintenance staff. The technician here made a deliberate choice to open the door, so the access was granted rather than stolen.

(A) Incorrect — tailgating (EK 2.2.A.3) requires following close behind without the authorized person’s awareness or knowledge; this technician knowingly held the door.

(C) Incorrect — shoulder surfing (EK 2.2.A.4) is watching a user access sensitive information for later use; observing a badge tap yields nothing the courier could reuse.

(D) Incorrect — card cloning (EK 2.2.A.6) requires copying an authorized user’s access card; the courier presented no card at all.

Exam Tip: Separate piggybacking from tailgating with one question — did an authorized person knowingly let the adversary in? Knowingly is piggybacking; unaware is tailgating.

Q2 Risk Assessment

The assessment log lists three findings at the new lab. Decide your own answer before reading the options: which findings represent a HIGH risk from a physical vulnerability?
I. A rack of servers holding participant medical records sits in an unlocked storage room reached through a hallway with no camera coverage.
II. The lobby receptionist’s workstation is joined to the internal wireless network and has enabled USB ports; visitors wait unescorted beside it.
III. Engineers in the badge-access design office leave non-sensitive loaner laptops uncabled on their desks during a weekly team lunch.

(A) I only (B) I and II only (C) II and III only (D) I, II, and III

High risk arises when sensitive information or systems are exposed in a physical space without sufficiently restricted and controlled access (EK 2.2.C.2), which is finding I exactly. Finding II is the moderate-risk pattern (EK 2.2.C.3): a non-sensitive part of the organization left unprotected in a way that could act as a foothold for gaining initial access to other resources. Finding III is low risk (EK 2.2.C.4): a low-value asset whose vulnerability is unlikely to be exploited.

(B) Incorrect — the receptionist workstation is the moderate-risk case; it is a foothold toward other resources, not sensitive data or systems left directly exposed.

(C) Incorrect — neither finding II nor finding III exposes sensitive systems to uncontrolled access, so neither one reaches the high band.

(D) Incorrect — grading every finding as high destroys the prioritization that the assessment exists to produce, and it contradicts the low-risk definition in EK 2.2.C.4.

Exam Tip: Band a physical finding on two axes — how sensitive is what is exposed, and how controlled is access to it. “It could eventually lead somewhere” is moderate, not high.

Q3 Spot the Error

An intern adds this note to the assessment: “The lab’s network closet has no lock, but every server inside is fully patched and all stored data is encrypted at rest, so an adversary who reaches the closet cannot cause loss, damage, or disruption.” Which statement identifies the error in the intern’s reasoning?

(A) The note is sound, because current patching and encryption at rest together remove the risk created by the unlocked closet (B) The note is flawed, because patching and encryption are managerial controls and so cannot protect servers sitting in a closet (C) The note is flawed, because encryption at rest stops protecting data the moment a server is powered on, so the data is never secured (D) The note is flawed, because physical access lets an adversary cut power or destroy the hardware, disrupting services no matter how the servers are patched or encrypted

Physical access to a device allows an adversary to bypass many technical controls and layers of security (EK 2.2.C.1). Patching and encryption defend confidentiality and integrity against remote attacks; neither one stops someone from tripping a breaker, cutting wiring, or destroying a drive, and destroying a device makes the device, its data, and its services unavailable (EK 2.2.B.3, EK 2.2.B.5). The note also ignores the port-level attacks physical access enables, such as plugging in a keylogger or a malware-loaded external drive.

(A) Incorrect — this repeats the intern’s error. A compromise includes disruption of services and destruction of resources, not only disclosure of data (EK 2.2.B.2).

(B) Incorrect — patching and anti-malware settings are technical controls, and the miscategorization is not what makes the intern’s conclusion wrong.

(C) Incorrect — encryption at rest exists to protect stored data on powered-down or stolen media; the claim that it never secures data is simply false.

Exam Tip: When a note concludes that a physical gap “does not matter,” test it against all four compromise types — unauthorized access, disruption of services, theft or destruction, and unauthorized modification. Availability is where physical attacks usually win.

Q4 Compromise Type

The team is ranking four findings by how much each one raises the risk that an adversary could read or copy sensitive research data. Which finding contributes LEAST to that specific risk?

(A) The recycling bin behind the loading dock is unlocked and holds unshredded printouts of experiment logs (B) A drawer of unencrypted backup drives sits in an unlocked file room reached through an unmonitored hallway (C) The breaker panel feeding the ground-floor server room is mounted outside the building and its cover is unlocked (D) A shared workstation faces the visitor waiting area, and its screen displays participant records to anyone seated there

All four are real physical vulnerabilities, but they do not all produce the same compromise. A, B, and D each end with an adversary reading or copying sensitive information — dumpster diving (EK 2.2.A.5), stealing or copying data from an accessible area (EK 2.2.B.4), and shoulder surfing (EK 2.2.A.4). An unlocked exterior breaker panel supports a different compromise: disrupting power makes the device and any services it provides unavailable (EK 2.2.B.3). It still belongs in the assessment — just not under this risk.

(A) Incorrect — unshredded experiment logs in an unlocked bin is dumpster diving, a direct route to copying sensitive information.

(B) Incorrect — unencrypted backup drives in an unlocked room can be carried out and copied wholesale, the highest-yield version of this exact risk.

(D) Incorrect — a screen facing a waiting area is a standing shoulder-surfing opportunity, and a seated visitor with a phone can record it for later analysis.

Exam Tip: When a stem narrows the risk to reading or copying data, sort findings by which compromise each one produces. A power or destruction finding is not the least serious overall — only the least relevant to a confidentiality question.

Q5 Threat Sources

The new lab sits in a river floodplain and its ground-floor server room has no water sensors and no raised flooring. A facilities manager objects: “Flooding is a maintenance issue, not a security issue — leave it out of the vulnerability assessment.” Which response BEST corrects the manager?

(A) The finding belongs in the assessment only if an adversary could deliberately trigger the flooding (B) The finding belongs in the assessment because threats include natural disasters as well as human adversaries, and both can damage devices and disrupt the services they provide (C) The finding belongs in the assessment because water damage is the leading cause of permanent data loss at research facilities nationwide (D) The finding belongs in the maintenance report, because a vulnerability assessment documents only attacks the organization has already suffered

Threats include human adversaries seeking to cause harm or disruption as well as natural disasters, which can physically damage or destroy computers and data and disrupt the digital services those computers provide (EK 2.2.B.1). A floodplain server room with no water detection is a documented physical vulnerability with a real likelihood and impact, so it belongs in the assessment beside piggybacking and unlocked doors.

(A) Incorrect — limiting threats to deliberate human action is precisely the omission EK 2.2.B.1 rules out.

(C) Incorrect — the conclusion is right but the reason is an invented statistic; an assessment documents likelihood and impact for this site, not an unsourced national ranking.

(D) Incorrect — an assessment evaluates weaknesses that could be exploited, so waiting for an incident to occur defeats its purpose.

Exam Tip: A threat does not require intent. If a natural event can make a device or its services unavailable, it is in scope for a physical vulnerability assessment.

Questions Correct

Course Hub → Course Hub

← Lab 2.2 Course Hub →

AP Cybersecurity Unit 2 • 2.2 • Quiz | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 2 · Lesson 2.2 · Quiz

Lesson•Exercise 1•Exercise 2•Lab•Quiz•Next: 2.3 Protecting Physical Spaces →

Back to:Lesson 2.2 Unit 2 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]