Topic 3.1 Exercise 1: Network Fundamentals Assessment | AP Cybersecurity

Unit 3 • 3.1 • Exercise 1

Home›AP Cybersecurity›Unit 3 › 3.1 › Exercise 1

Exercise 1 — Network Fundamentals Assessment

6 questions — Evaluate network architecture and attack surface concepts

Score: 0 / 0 Predict the answer before selecting an option

Client Organization

Brightpath University

Brightpath University operates a campus network serving 15,000 students, 2,000 faculty, and 500 administrative staff. The network includes student Wi-Fi, faculty workstations, research lab servers, a student information system (SIS), and IoT devices (smart boards, security cameras, HVAC). The IT security team is conducting a network architecture review.

Q1 Attack Surface

Brightpath’s IT team inventories the campus network: 3,000 student laptops on Wi-Fi, 800 faculty workstations, 45 servers, 200 IoT devices, a VPN gateway, 12 web applications, and a guest Wi-Fi portal. Which statement BEST describes the university’s attack surface?

(A) The attack surface is only the VPN gateway because it is the sole entry point from the internet (B) The attack surface is the total set of all points where an attacker could attempt entry or extraction — every device, service, port, account, and API exposed to threats (C) The attack surface equals the number of antivirus licenses purchased (D) The attack surface is determined by the physical size of the campus

Attack surface = every potential entry/exit point. For Brightpath: 4,000+ endpoints, 45 servers, 200 IoT devices, VPN, 12 web apps, guest Wi-Fi, user accounts, APIs. Reducing attack surface means minimizing unnecessary exposure.

(A) The VPN is one entry point; the attack surface includes every device and service.

(C) License count is an inventory metric, not an attack surface measure.

(D) Physical campus size does not determine network attack surface.

Exam Tip: Attack surface = everything an attacker could target. Larger organizations have larger surfaces. Reducing it means disabling unused services, closing ports, and segmenting access.

Q2 OSI Layers

A Brightpath network engineer troubleshoots connectivity between a student laptop and the SIS server. The issue is that the laptop can reach the server’s IP address (ping works) but cannot load the web application (HTTPS fails). At which OSI layer is the problem MOST likely occurring?

(A) Layer 1 (Physical) — the Ethernet cable is damaged (B) Layer 3 (Network) — the IP routing is broken (C) Layer 7 (Application) — the web server or TLS configuration is the issue since IP connectivity works but the application does not respond (D) Layer 2 (Data Link) — the switch port is misconfigured

Ping (ICMP) works at Layer 3, proving IP routing is functional. Layers 1-3 are working. The failure at HTTPS (Layer 7) points to the web server configuration, TLS certificate, or application-level issue.

(A) If the cable were damaged, ping would also fail.

(B) If routing were broken, ping would not reach the server.

(D) If the switch port were misconfigured, no traffic would flow at all.

Exam Tip: Troubleshooting with OSI: if lower layers work (ping succeeds = L1-3 OK), the problem is at a higher layer. HTTPS failure with working ping = Layer 7 issue.

Q3 TCP vs UDP

Brightpath’s video lecture streaming platform uses UDP for live video delivery but TCP for the student login portal. Which of the following BEST explains this design choice?

(A) UDP is more secure than TCP, so it is used for the more valuable video content (B) TCP guarantees ordered, reliable delivery (essential for login credentials) while UDP prioritizes speed over reliability (acceptable for video where dropped frames are barely noticeable) (C) UDP encrypts video automatically while TCP does not support encryption (D) TCP is faster than UDP but less reliable, making it better for authentication

TCP provides reliable, ordered delivery with error correction — critical for authentication where every byte matters. UDP sacrifices reliability for speed — acceptable for video streaming where a dropped frame is invisible to viewers.

(A) UDP is not inherently more secure; it lacks TCP’s reliability features.

(C) Neither protocol provides built-in encryption; TLS adds encryption to TCP.

(D) Reversed — TCP is more reliable but slower; UDP is faster but unreliable.

Exam Tip: TCP = reliable, ordered (web, SSH, email, login). UDP = fast, no guarantee (video, DNS, VoIP, gaming). Choose by whether the application tolerates data loss.

Q4 Network Addressing

A security scan reveals that a Brightpath research server has 47 open ports. The server only needs ports 443 (HTTPS management), 22 (SSH administration), and 3306 (MySQL database). What should the IT team do with the remaining 44 ports?

(A) Leave them open in case future applications need them (B) Rename the ports to non-standard numbers so attackers cannot find them (C) Close all 44 unnecessary ports — each open port is a potential entry point that expands the attack surface (D) Open 44 additional ports on other servers to distribute the risk evenly

Every open port is an attack surface entry point. Closing unnecessary ports is one of the most effective hardening measures. The server needs 3 ports; the other 44 offer zero value and 44 additional risks.

(A) Keeping ports open “just in case” is a security anti-pattern.

(B) Security through obscurity (renaming ports) is easily defeated by scanning tools.

(D) Opening more ports on more servers increases total attack surface.

Exam Tip: Port hardening: identify needed services, close everything else. Nmap can discover non-standard port numbers in seconds, so renaming provides no real protection.

Q5 DNS

A phishing attack targets Brightpath by compromising the campus DNS server. The attacker modifies the DNS record for portal.brightpath.edu to point to the attacker’s server instead of the real SIS. Students who type the correct URL are redirected to a fake login page. Which statement is CORRECT?

(A) This attack is impossible because DNS records cannot be modified by unauthorized parties (B) Students would notice the redirection immediately because the fake site would have a different URL in the address bar (C) The URL in the address bar shows the correct domain (portal.brightpath.edu) because DNS translates the name to the attacker’s IP — the browser has no way to know the IP is wrong without additional verification like DNSSEC (D) The attack only works if the student misspells the URL

DNS spoofing is dangerous precisely because the URL looks correct. The browser resolves the domain to whatever IP the DNS server provides. Without DNSSEC or certificate validation, the student sees the correct URL pointing to the wrong server.

(A) DNS cache poisoning and server compromise are well-documented attack vectors.

(B) The URL is correct — DNS changes the IP behind it, not the domain name.

(D) The attack works with the correct URL; that is what makes it effective.

Exam Tip: DNS spoofing = correct URL, wrong server. Defenses: DNSSEC (cryptographic verification of DNS responses) and HTTPS certificate validation (the fake server cannot present a valid cert for brightpath.edu).

Q6 Network Topology

Brightpath’s network diagram shows the campus firewall connected to the internet, a DMZ containing the public web server, an internal network with VLANs for students/faculty/admin, and a separate SCADA network for building automation. Which of the following is NOT a valid reason for documenting this topology?

(A) Topology diagrams help security teams identify potential attack paths from the internet to critical systems (B) Topology documentation supports incident response by showing how systems are connected and where to isolate threats (C) Publishing the topology diagram on the university’s public website demonstrates transparency and builds trust with students (D) Topology maps help identify single points of failure and gaps in network segmentation

Publishing network topology publicly gives attackers a roadmap of the infrastructure. Topology documentation is an internal security tool — it helps defenders plan, but it must be protected as sensitive information.

(A) Valid — topology diagrams reveal attack paths for defensive analysis.

(B) Valid — incident response requires understanding network connectivity.

(D) Valid — topology maps reveal single points of failure and segmentation gaps.

Exam Tip: Network topology = sensitive internal documentation. It helps defenders plan and attackers navigate. Never publish externally. Restrict access to IT and security teams.

Questions Correct

Exercise 2 → Course Hub

← Lesson 3.1 Exercise 2 →

AP Cybersecurity Unit 3 • 3.1 • Exercise 1 | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 3 · Lesson 3.1 · Exercise 1

Lesson•Exercise 1•Exercise 2 →•Lab•Quiz

Back to:Lesson 3.1 Unit 3 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]