AP Cybersecurity Unit 2 Lesson 4 Lab
Unit 2 • 2.4 • Lab
Lab — Watching Delmar: Applying Detection Across the Building
6 steps, 30 points — Mixed formats: matching, fill-blank, select-all, MCQ, and written analysis
Score: 0 / 30Each step uses a different assessment format
Investigation Target
Delmar Applied Optics — Detection Review
Xtensr Research Labs finished hardening the Delmar building last quarter. The finished-lens vault now has a badge reader, a door contact, an access control vestibule and an interior motion sensor; the engineering file server sits in a locked cabinet; the badge controller cabinet has a locked enclosure and a tamper switch; the reception PC has port blockers and a privacy screen; the testing bay has a UPS; and the below-grade optics bay has flood barriers with its racking above grade. Four months ago a small operating budget added the monitoring layer: a camera on the vault door, a camera on the loading-dock roll-up door, motion sensors in the vault interior and the file-server room, and one officer patrolling the exterior and the below-grade optics bay. Xtensr’s security committee has asked you to review what this building can actually detect — area by area — before the next operating cycle is funded.
Step 1Matching
Identify What Did the Detecting
Three unauthorized-access incidents at Delmar were caught. Match each account to the control that actually did the detecting.
✎ Think first: Ask who or what was present at that moment, and whether the signal was an alert, an observation, or a recording reviewed later.
A machinist saw an unfamiliar man in a company polo carrying a lens tray toward the loading dock and called security
→
At 2:14 a.m., with the building empty and no work scheduled, an alert fired for movement inside the vault
→
Two days after a tray went missing, reviewing the previous Friday night showed someone propping the roll-up door open with a wedge
→
The machinist is an employee in the space (EK 2.4.A.4) — the people who work in an area are often the first to notice someone who does not belong, and they can alert security. The 2:14 a.m. alert is a motion sensor (A.3): it reported movement where movement was not expected. The propped door came from a camera recording (A.1), reviewed after the fact. Officer on patrol detected none of the three — Delmar’s officer walks the exterior and the below-grade optics bay, and a patrol only sees what is happening as it passes.
Exam Tip: The four detection mechanisms in 2.4.A do not report at the same moment. Sensors and guards report while it is happening; employees report while it is happening if they are there; recordings answer the question afterward. When an item describes a detection, ask what was present at that instant — that usually names the control before you read the options.
Step 2Fill in the Blank
Complete the Detection Vocabulary
Fill in the CED term that completes each rule about detection controls.
✎ Think first: Each blank names a condition that separates a control that detects from one that merely exists.
For maximum effect a camera feed should be recorded and .
Cameras usually go at the points of ingress and .
Motion sensors belong in areas where traffic is .
A stationary post works best where building traffic .
Employees who work in a space are often the to notice an unauthorized person.
Answers: (1) monitored. (2) egress. (3) unexpected. (4) funnels. (5) first.
Exam Tip: A camera that records but is never watched detects nothing while it is happening — it only helps afterward. A sensor in a busy area produces false alarms until people ignore it. A stationary post covers one place constantly; a patrol covers many places intermittently. Each of these five words is the difference between a control that detects and one that is merely installed.
Step 3Select All That Apply
Find the Detection Gaps
Delmar’s detection plan is exactly this: a camera on the vault door, a camera on the loading-dock roll-up door, motion sensors in the vault interior and the file-server room, and one officer patrolling the exterior and the below-grade optics bay. Select ALL of the statements that correctly name something this plan cannot detect.
✎ Think first: Walk the building room by room and ask what signal each room would produce. A control that prevents an attack does not necessarily report one.
Real gaps: the reception PC after hours, the testing bay and the main corridor. Each holds preventive controls or none at all, and nothing in any of them produces a signal. The badge controller cabinet is not a gap — the tamper switch installed with the enclosure exists precisely to report that the cabinet was opened, which is detection, not prevention. The vault claim is wrong twice over: a feed that is recorded and monitored does detect, and the vault also carries an interior motion sensor.
Exam Tip: The scorer subtracts wrong selections, so the question is not “is this a fair criticism?” but “does this name something the plan cannot detect?” Two habits catch most of these: list the controls in each area and label each one prevent or detect, and check every claim about the scenario against the facts you were given before deciding whether it matters.
Step 4Multiple Choice
Turn Employees Into a Detection Control
Delmar’s machinists, lens techs and reception staff are in the building all day and know who belongs in each area. Xtensr’s committee wants them working as a detection control. Which change is MOST likely to make that happen?
✎ Predict first: An employee detection has two halves. Decide what both of them are before you read the options.
B is correct. EK 2.4.A.4 says employees who work in the space are often the first to notice an unauthorized person and can alert security, so the control needs two halves: a trigger they can recognize without security training, and a channel that reaches somebody who will respond. (A) is deterrence aimed at the adversary, not detection — a sign produces no report. (C) is a real managerial control, and the gap survives it: an annual course and a signature still leave an employee with nothing specific to look for and nobody to call in the moment. (D) inverts the mechanism — their value is that they already know who belongs in their own space, and a second screen makes them worse monitors and worse machinists.
Exam Tip: Test any awareness measure by asking what an employee would actually do in the ten seconds after noticing something wrong. If the measure does not answer that, it is training or deterrence, not detection.
Step 5Analysis
Establish Who Was in the Vault
A tray of finished lenses worth $40,000 was in the vault at Friday’s 5 p.m. count and gone at Monday’s 8 a.m. count. The vault reader’s log shows one badge used across the weekend — the shift supervisor’s, at 6:12 p.m. Friday — and she says she lent it to a technician that evening. The interior sensor logged motion at 6:12 p.m. and again at 6:31 p.m. The vestibule and door contact recorded nothing unusual.
5a. Which existing control is MOST likely to establish who was in the vault?
5b. Name what the footage can establish that the badge log and the sensor cannot, and say what the investigator must be able to do with the recording for it to be worth anything.
Key terms: not a person, borrowed, lent, who entered, carried, how many, identify, review, retrieve, overwritten, time stamp, sequence
B is correct. The camera recording is the only control here that carries identity. The sensor (A) logs that motion happened and when — 6:12 and 6:31 — but not who was moving or what they carried. The officer (C) never enters the vault: the patrol covers the exterior and the below-grade optics bay. The badge log (D) has already been read, and it names a badge, not a person — a lent badge opens the door under someone else’s name, and the vestibule cannot help because the badge holder consented. The footage can show how many people entered, whether a face is identifiable, what was carried out and in what sequence, each with a time stamp. For any of that to matter the investigator must be able to retrieve the weekend’s recording before it is overwritten, and somebody has to review it.
Exam Tip: Access logs and sensors record events; cameras record people. When a question asks who, look for the control that captures identity; when it asks whether something happened, a log or a sensor is enough. And a recording answers nothing if it is gone from the server by the time somebody goes looking.
Step 6Written Response
Write the Detection Plan for the Uncovered Areas
Three areas at Delmar currently produce no detection signal at all: the reception lobby, the testing bay and the main corridor. Write one detection control for each. For every area say what the control would let someone detect and who or what turns that signal into a response. One of the three must use people rather than equipment.
Key terms: employee, first to notice, what to report, one number, unescorted, motion sensor, unexpected, empty, few authorized, camera, recorded and monitored, funnel, who moved, between rooms, doorway, respond, as it happens, brief
Model: Reception lobby — people. The reception staff are employees who sit in that space all day and know who has been checked in, so they are the first to notice an unescorted visitor past the desk or a stranger at the PC; brief them on exactly what to report and give them one number that reaches a responder as it happens. Testing bay — a motion sensor. Few authorized people use it and it sits empty most of the day, so movement there is unexpected and worth an alert rather than a false alarm, and the alert goes to whoever is on duty to respond. Main corridor — a camera. Put it where the corridor funnels past the doorways it has to cover, recorded and monitored, so it shows who moved between rooms and when. All three name a control, what it detects, and who acts on the signal.
Exam Tip: A detection plan is not a shopping list. For each area the CED wants three things: a control suited to how that space is actually used, a statement of what it would let somebody detect, and a person who receives the signal. Leave out any of the three and the area is still uncovered.
AP Cybersecurity 2.4 Lab | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board.
AP® is a registered trademark of the College Board.
AP Cybersecurity · Unit 2 · Lesson 2.4 · Lab
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Typically responds within 24 hours
✓
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]