AP Cybersecurity Unit 3 Lesson 6 Exercise 1

Unit 3 • 3.6 • Exercise 1

Home›AP Cybersecurity›Unit 3 › 3.6 › Exercise 1

Exercise 1 — Secure Protocol Analysis

6 questions — Evaluate protocol choices and encryption implementations

Score: 0 / 0 Predict the answer before selecting an option

Client Organization

Brightpath University

Brightpath University is upgrading its network infrastructure to eliminate insecure protocols. The IT security team has audited all network services and found that several departments still use legacy protocols that transmit data in plaintext. You are reviewing six protocol decisions and recommending secure alternatives.

Q1 HTTP vs HTTPS

Brightpath’s student portal currently runs on HTTP (port 80). Students log in with their university credentials to view grades, register for classes, and pay tuition. The IT team proposes migrating to HTTPS (port 443). Which of the following BEST describes what HTTPS adds that HTTP does not provide?

(A) HTTPS verifies the student’s identity before allowing them to access the portal, replacing the need for a username and password (B) HTTPS encrypts data in transit between the student’s browser and the server using TLS, preventing eavesdroppers from reading credentials or financial data (C) HTTPS compresses all web traffic to reduce bandwidth usage, making the portal load faster on the campus Wi-Fi network (D) HTTPS scans uploaded files for malware before they reach the server, protecting against infected assignment submissions

HTTPS wraps HTTP inside a TLS (Transport Layer Security) tunnel. This encrypts all data exchanged between the browser and server — including login credentials, grade data, and payment information — making it unreadable to anyone who intercepts the traffic.

(A) Incorrect — HTTPS does not replace authentication; students still need credentials. HTTPS protects those credentials in transit.

(C) Incorrect — HTTPS provides encryption, not compression. HTTP/2 includes compression features, but that is independent of TLS.

(D) Incorrect — HTTPS encrypts the transport layer; it does not perform malware scanning on file content.

Exam Tip: HTTP = plaintext. HTTPS = HTTP + TLS encryption. The “S” stands for Secure, meaning the transport is encrypted. It does not replace authentication or scan content.

Q2 Telnet vs SSH

The Computer Science department uses Telnet (port 23) to remotely manage Linux lab servers. A security audit flags this as a critical vulnerability. Which of the following statements about this risk are correct?

I. Telnet transmits all data, including passwords, in plaintext that can be captured by anyone on the network path.
II. SSH (port 22) provides the same remote terminal functionality as Telnet but encrypts the entire session.
III. Replacing Telnet with SSH requires replacing all the Linux servers with newer hardware.

(A) I only (B) I and II only (C) II and III only (D) I, II, and III

Statement I is correct — Telnet sends everything, including authentication credentials, as readable plaintext. Statement II is correct — SSH provides encrypted remote terminal access with the same functionality. Statement III is incorrect — SSH is a software protocol that runs on existing hardware; no server replacement is needed.

(A) Incomplete — Statement II is also correct.

(C) Incorrect — includes the false Statement III.

(D) Incorrect — Statement III is false; SSH is a software upgrade, not a hardware requirement.

Exam Tip: Insecure → Secure replacements: Telnet → SSH, FTP → SFTP/FTPS, HTTP → HTTPS. The secure version encrypts the same functionality.

Q3 TLS Certificates

A student visiting the Brightpath library website sees a browser warning: “Your connection is not private — the certificate for library.brightpath.edu has expired.” The student clicks “Proceed anyway.” Which risk does this action introduce?

(A) The expired certificate means all data on the library server has been deleted and the student will see an empty page (B) The student’s browser will automatically download malware because expired certificates disable all browser security features (C) The connection may still be encrypted, but the student cannot verify the server’s identity — an attacker could be intercepting the connection using their own certificate (D) The expired certificate causes the student’s device to become visible to all other users on the campus network

An expired certificate means the browser cannot verify that the server is who it claims to be. The TLS encryption may still function, but without a valid certificate, a man-in-the-middle attacker could present their own certificate and intercept all traffic. Clicking “Proceed anyway” bypasses this critical verification step.

(A) Incorrect — certificate expiration does not affect server data; it affects trust verification.

(B) Incorrect — expired certificates do not disable browser security or trigger automatic downloads.

(D) Incorrect — certificate status has no effect on device visibility on the network.

Exam Tip: Certificate warnings mean the identity verification chain is broken. Encryption may still work, but you cannot be sure WHO you are encrypting to. This is exactly how MitM attacks succeed.

Q4 FTP vs SFTP

The Admissions Office transfers applicant files to a partner institution using FTP (port 21). The files contain Social Security numbers, transcripts, and financial aid data. The partner suggests switching to SFTP. Which of the following is NOT a valid reason to make this switch?

(A) FTP transmits files and credentials in plaintext, exposing applicant SSNs to anyone who can intercept the network traffic (B) SFTP uses SSH to encrypt the entire file transfer session, protecting both the data and the authentication credentials (C) SFTP transfers files faster than FTP because encryption compresses the data before transmission (D) Regulatory compliance (FERPA) requires protecting student records in transit, which FTP cannot provide

SFTP does NOT transfer files faster due to encryption. In fact, encryption adds computational overhead that can slightly reduce throughput. SFTP’s benefit is security (encryption), not performance. Options A, B, and D are all valid reasons to switch from FTP to SFTP.

(A) Valid reason — FTP plaintext transmission of SSNs is a critical vulnerability.

(B) Valid reason — SFTP encrypts the entire session using SSH.

(D) Valid reason — FERPA requires protection of student educational records, including during transmission.

Exam Tip: Encryption adds security but also adds processing overhead. It never makes transfers faster. If an answer claims encryption improves speed, it is incorrect.

Q5 VPN Protocols

Brightpath offers VPN access for faculty working remotely. The IT team is choosing between two configurations: (1) split-tunnel VPN that only routes university-bound traffic through the encrypted tunnel, or (2) full-tunnel VPN that routes ALL traffic through the university network. Which of the following BEST describes a security advantage of full-tunnel over split-tunnel?

(A) Full-tunnel VPN encrypts traffic faster because it processes all packets in a single stream rather than sorting them by destination (B) Full-tunnel VPN routes all traffic through the university’s security infrastructure (firewall, IDS, content filter), protecting faculty even when accessing non-university websites (C) Full-tunnel VPN eliminates the need for endpoint antivirus software because all threats are blocked at the university perimeter (D) Full-tunnel VPN allows faculty to access streaming services that are geographically restricted to the university’s location

Full-tunnel VPN forces ALL traffic — including personal web browsing, email, and cloud services — through the university’s network perimeter. This means the university’s firewall, IDS, and content filters inspect everything, providing the same protection as being on campus. Split-tunnel only protects university-bound traffic.

(A) Incorrect — full-tunnel does not encrypt faster; it actually increases bandwidth load on the VPN concentrator.

(C) Incorrect — perimeter security does not replace endpoint protection; defense in depth requires both.

(D) Incorrect — geographic content access is a side effect, not a security advantage.

Exam Tip: Split-tunnel = faster (less VPN bandwidth) but less secure. Full-tunnel = more secure (all traffic inspected) but higher bandwidth cost. The tradeoff is security vs. performance.

Q6 DNS Security

Brightpath’s DNS queries are currently sent in plaintext over UDP port 53. A network administrator proposes implementing DNS over HTTPS (DoH). Which of the following is a LEGITIMATE concern about deploying DoH on the campus network?

(A) DoH encrypts DNS queries, which prevents the university’s content filtering and security monitoring tools from inspecting DNS traffic to block malicious domains (B) DoH is incompatible with all modern web browsers and would require students to install custom software (C) DoH eliminates the ability to resolve domain names entirely, breaking all web browsing on campus (D) DoH transmits DNS queries in plaintext over port 443, providing no additional security over standard DNS

DoH encrypts DNS queries inside HTTPS, which protects student privacy but also blinds the university’s DNS-based security tools. Content filters, malware domain blocklists, and DNS monitoring all rely on reading DNS queries — DoH makes this traffic opaque. This is a real tradeoff between privacy and institutional security visibility.

(B) Incorrect — DoH is supported natively by Chrome, Firefox, Edge, and Safari.

(C) Incorrect — DoH still resolves domains; it just encrypts the query transport.

(D) Incorrect — DoH encrypts DNS inside HTTPS; it does NOT send plaintext.

Exam Tip: Encryption is a double-edged sword: it protects privacy but can blind security monitoring. DoH is a real-world example of this tension between privacy and security visibility.

Questions Correct

Exercise 2 → Course Hub

← Lesson 3.6 Exercise 2 →

AP Cybersecurity Unit 3 • 3.6 • Exercise 1 | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 3 · Lesson 3.6 · Exercise 1

Lesson•Exercise 1•Exercise 2 →•Lab•Quiz

Back to:Lesson 3.6 Unit 3 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]