AP Cybersecurity Unit 3 Lesson 2 Quiz

Unit 3 • 3.2 • Quiz

Home›AP Cybersecurity›Unit 3 › 3.2 › Quiz

Lesson 3.2 Quiz: Network Attacks

5 questions — Demonstrate your understanding of network attack techniques

Score: 0 / 0 Answer each question, then check your score below

Scenario Organization

Crossroads Logistics

Crossroads Logistics is a freight and shipping company operating a fleet of 200 trucks with IoT-based GPS tracking, a centralized dispatch system, and warehouse inventory management across 5 distribution centers. Each facility connects to headquarters over the company’s WAN.

Q1 Attack Classification

Crossroads’ dispatch portal becomes unresponsive during peak shipping hours. The SOC identifies 50,000 SYN packets per second arriving from a single IP address, all targeting port 443. The server’s connection table is full. This is BEST classified as:

(A) A SYN flood denial-of-service attack targeting the server’s ability to establish new TCP connections (B) A distributed denial-of-service attack using a botnet to overwhelm the portal with traffic from multiple sources (C) An ARP poisoning attack redirecting dispatch traffic through the attacker’s device before reaching the server (D) A DNS amplification attack using Crossroads’ server as a reflector to flood third-party targets

Single source IP + SYN packets + full connection table = classic SYN flood (DoS, not DDoS). The attacker exhausts the server’s half-open connection limit with unanswered TCP handshakes.

(B) Incorrect — DDoS involves multiple source IPs; this attack comes from a single address.

(C) Incorrect — ARP poisoning operates at Layer 2 on the local network, not via external SYN packets.

(D) Incorrect — DNS amplification uses UDP-based DNS responses, not TCP SYN packets.

Exam Tip: Single source = DoS. Multiple sources = DDoS. SYN flood specifically targets the TCP three-way handshake.

Q2 MitM Detection

A network technician at the Atlanta distribution center notices that their browser shows a certificate warning when accessing the internal inventory system. The certificate issuer has changed from the company’s internal CA to an unknown authority. Which attack does this evidence MOST suggest?

(A) SQL injection — the attacker is manipulating database queries through the inventory system’s search function (B) Cross-site scripting — the attacker has injected malicious JavaScript into the inventory system’s web pages (C) Passive packet sniffing — the attacker is silently capturing traffic without modifying any data in transit (D) Man-in-the-middle attack — the attacker is intercepting and re-encrypting traffic using their own certificate

A changed certificate issuer is a hallmark of TLS interception (a man-in-the-middle attack). The attacker decrypts traffic using their own certificate, reads or modifies it, then re-encrypts it toward the destination.

(A) Incorrect — SQL injection targets the application layer; it would not change the TLS certificate.

(B) Incorrect — XSS injects scripts into web pages; it does not alter the server’s TLS certificate.

(C) Incorrect — passive sniffing does not modify traffic or certificates; it only observes.

Exam Tip: Certificate warnings = someone is intercepting the encrypted connection. The browser is telling you the encryption chain has been tampered with.

Q3 Attack Impact

An attacker compromises a DNS server used by Crossroads’ truck fleet GPS units and redirects the domain for the tracking API to a server the attacker controls. Which of the following impacts is the attacker LEAST likely to achieve through this attack alone?

(A) Sending false GPS coordinates to dispatchers, causing delivery route confusion (B) Collecting real-time location data from the fleet as trucks report their positions to the fake server (C) Encrypting data stored on the fleet GPS units with ransomware (D) Intercepting authentication tokens sent by the GPS units to the tracking API

DNS spoofing redirects network traffic to a different destination — it does not grant the attacker the ability to execute code on the GPS devices themselves. Installing ransomware requires exploiting a vulnerability on the device, not just redirecting its network requests.

(A) Achievable — the fake server could send fabricated route data back to the GPS units.

(B) Achievable — trucks would send their location reports to the attacker’s server.

(D) Achievable — any credentials sent to the redirected server would be captured by the attacker.

Exam Tip: DNS spoofing controls WHERE traffic goes, not WHAT runs on the device. It enables interception and data theft but not direct code execution on endpoints.

Q4 Defense Strategy

Which of the following countermeasure combinations would MOST effectively protect Crossroads from both ARP poisoning on the warehouse LAN and session hijacking on the company WAN?

(A) Deploy antivirus software on all warehouse workstations and require password changes every 90 days (B) Enable Dynamic ARP Inspection (DAI) on warehouse switches and enforce HTTPS for all internal applications (C) Install physical locks on all network switch closets and require VPN connections for warehouse staff (D) Configure MAC address filtering on warehouse access points and block ICMP traffic at the WAN firewall

DAI validates ARP packets against a trusted binding table, directly preventing ARP poisoning. HTTPS encrypts session tokens in transit, preventing session hijacking even if traffic is intercepted. Each countermeasure directly addresses its respective attack vector.

(A) Incorrect — antivirus does not detect ARP poisoning, and password rotation does not prevent session token theft.

(C) Incorrect — physical locks protect hardware, not network protocols; VPN protects WAN traffic but does not address ARP attacks.

(D) Incorrect — MAC filtering is easily bypassed via MAC spoofing, and blocking ICMP does not prevent session hijacking.

Exam Tip: Match each countermeasure to the specific attack vector it addresses. The best answer directly neutralizes both named threats.

Q5 Protocol Analysis

A Crossroads security analyst captures the following sequence in a packet trace from the warehouse network:

1. Host A sends an ARP reply to the switch: “192.168.1.1 is at AA:BB:CC:DD:EE:FF”
2. The gateway’s actual MAC address is 00:11:22:33:44:55
3. All traffic from warehouse workstations now routes through Host A

Which statement about this sequence is INCORRECT?

(A) Host A is conducting ARP poisoning by sending a forged ARP reply that maps the gateway’s IP to Host A’s MAC address (B) After step 3, Host A can inspect, modify, or drop all traffic between the workstations and the internet (C) This attack can only succeed if Host A has physical access to the same network switch as the gateway (D) Dynamic ARP Inspection (DAI) on the switch would prevent this attack by validating ARP replies against a trusted database

ARP poisoning does not require physical access to the same switch as the gateway — it only requires that the attacker be on the same Layer 2 broadcast domain (VLAN/subnet). The attacker can be connected to any port on any switch within the same broadcast domain and still send forged ARP replies that reach all hosts.

(A) Correct statement — this accurately describes the ARP poisoning technique shown in the trace.

(B) Correct statement — the MitM position gives Host A full visibility and control over intercepted traffic.

(D) Correct statement — DAI is the standard Layer 2 defense against ARP poisoning.

Exam Tip: When the stem asks for the INCORRECT statement, verify each option independently. Three will be true; one will be false.

Questions Correct

Course Hub → Course Hub

← Lab 3.2 Course Hub →

AP Cybersecurity Unit 3 • 3.2 • Quiz | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 3 · Lesson 3.2 · Quiz

Lesson•Exercise 1•Exercise 2•Lab•Quiz•Next: 3.3 Firewalls & ACLs →

Back to:Lesson 3.2 Unit 3 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]