Unit 3 Scenario Practice: Network Breach Investigations | AP Cybersecurity

Unit 3 • Scenario Practice

Home›AP Cybersecurity›Unit 3 › Scenario Practice

Unit 3 Scenario Practice: Network Breach Investigations

15 questions across 3 linked scenarios — Each scenario builds through multiple investigation phases

Score: 0 / 0 Read the full scenario before answering. Questions are linked.

Assessment Format

3 Linked Scenarios

Each scenario presents a multi-phase network breach investigation. Questions build on each other — your answer to Question 1 affects how you approach Question 2. Read each scenario carefully before answering.

Q1 Scenario A — NovaTech DDoS (Q1)

Scenario A: NovaTech Solutions — The SOC detects 500,000 SYN packets/sec from 30,000 IPs targeting the customer API. The API goes down in 2 minutes.

The traffic pattern (500K SYN packets/sec from 30K IPs, no ACK completion) indicates:

(A) A legitimate traffic spike from a viral marketing campaign (B) A single attacker sending spoofed SYN packets from one location (C) A DNS amplification attack targeting the API’s domain records (D) A Distributed Denial of Service (DDoS) SYN flood — distributed sources send half-open TCP connections to exhaust server resources

30,000 source IPs = distributed. SYN without ACK = half-open connections exhausting resources. Textbook DDoS SYN flood.

(A) Legitimate traffic completes handshakes; 500K SYN-only is not normal.

(B) 30K unique IPs = botnet, not single attacker.

(C) DNS amplification uses UDP, not TCP SYN.

Exam Tip: DDoS indicators: distributed sources, incomplete handshakes, volumetric rate far exceeding baseline.

Q2 Scenario A (Q2)

An engineer manually blocks attacker IPs one at a time. After 45 minutes, only 200 of 30,000 are blocked. Why is this failing?

(A) Manual blocking cannot keep pace with 30,000 distributed sources that rotate IPs faster than a human can respond — automated cloud scrubbing is required (B) The firewall cannot process IP blocking rules (C) 200 blocks is sufficient to stop the attack (D) The engineer should block all traffic on port 443 instead

At 200 blocks in 45 min, blocking all 30K IPs would take 112 hours — and the botnet rotates continuously. Manual cannot match automated attack speed.

(B) Firewalls can process blocks; the issue is human speed.

(C) 200 of 30K = 0.7%. Attack continues at 99.3%.

(D) Blocking 443 also blocks all legitimate customers.

Exam Tip: DDoS defense must be automated and upstream. Cloud scrubbing absorbs traffic before it reaches your infrastructure.

Q3 Scenario A (Q3)

While the DDoS distracts the SOC, an internal attacker performs ARP spoofing between engineering workstations and the database server. The SOC misses it because all analysts are triaging the DDoS.

(A) The DDoS was the actual attack; ARP spoofing is unrelated (B) ARP spoofing cannot occur during a DDoS because the network is too congested (C) The DDoS was a diversionary attack — its purpose was to consume SOC attention while the real attack (ARP spoofing for data interception) proceeded undetected (D) The SOC should have ignored the DDoS to focus on internal monitoring

Multi-phase attacks use DDoS as a smokescreen. While analysts triage the visible, noisy attack, the quiet internal compromise goes unnoticed.

(A) The attacks are coordinated — DDoS covers the real objective.

(B) ARP operates on the local LAN, independent of internet-facing congestion.

(D) Ignoring a customer-facing outage is not viable; the solution is adequate staffing.

Exam Tip: Multi-phase attacks: noisy attack distracts, quiet attack executes. SOCs need coverage for both external AND internal simultaneously.

Q4 Scenario A (Q4)

The attacker captures plaintext database queries via ARP spoofing. The internal interface uses HTTP. If it had used HTTPS, what would the attacker see?

(A) The same plaintext — HTTPS cannot protect against ARP spoofing (B) Encrypted gibberish — TLS encrypts the data even though ARP spoofing still routes traffic through the attacker, making interception useless (C) An error message telling the attacker they have been detected (D) Nothing — HTTPS prevents all network attacks including ARP spoofing

ARP spoofing works at L2 (traffic routes through attacker), but TLS encrypts at L7. Attacker sees encrypted bytes. TLS makes interception useless without preventing it.

(A) HTTPS encrypts data specifically to prevent interception.

(C) TLS does not detect ARP spoofing; it renders intercepted data unreadable.

(D) HTTPS cannot prevent L2 attacks — it just protects the payload.

Exam Tip: TLS at L4-7 + DAI at L2 = defense-in-depth. TLS cannot prevent ARP spoofing but makes it pointless.

Q5 Scenario A (Q5)

NovaTech implements: (1) cloud DDoS scrubbing, (2) DAI on switches, (3) mandatory HTTPS internally. Which threat does each fix address?

(A) All three address DDoS only (B) (1) DDoS volumetric attack, (2) ARP spoofing at L2, (3) data interception at L7 — each targets a different phase (C) (1) ARP spoofing, (2) DDoS, (3) DNS spoofing — the mapping is reversed (D) Only fix (3) is necessary; the others are redundant

Each fix targets a specific attack phase: cloud scrubbing (DDoS), DAI (ARP), HTTPS (data protection). Three layers, three defenses.

(A) Three different attacks need three different fixes.

(C) Mapping is incorrect — cloud scrubbing is for DDoS, not ARP.

(D) Removing any fix leaves a gap.

Exam Tip: Map controls to attack phases: upstream (DDoS), switch-level (ARP), application (data). Each operates independently.

Q6 Scenario B — Harborview VLAN Hopping (Q6)

Scenario B: Harborview Regional Bank — A pen tester plugs into a lobby Ethernet jack configured as a trunk port. They send 802.1Q-tagged frames for VLAN 30 (ATM Management) and access the ATM controller at 10.30.1.50 with admin/admin.

The misconfigured trunk port allowed the attacker to:

(A) Inject 802.1Q-tagged frames for VLAN 30, placing traffic on the ATM network despite being physically in the lobby — this is VLAN hopping (B) Crash the switch by overloading it with tagged frames (C) Encrypt all traffic using the trunk port’s built-in encryption (D) Access the internet through the trunk port’s public IP

VLAN hopping via trunk exploitation: tagged frames for the target VLAN through a misconfigured trunk port.

(B) Tagged frames do not crash switches.

(C) Trunk ports do not provide encryption.

(D) Trunk ports carry VLAN traffic, not public internet.

Exam Tip: VLAN hopping requires a trunk port. Access ports (single VLAN, no tagging) prevent this entirely.

Q7 Scenario B (Q7)

The inter-VLAN firewall has DENY Guest to ATM. But the attacker was not blocked. Why?

(A) The firewall was offline (B) The firewall rule was in the wrong order (C) DENY rules do not work on trunk traffic (D) The attacker’s tagged frames appeared as intra-VLAN 30 traffic — it never crossed a VLAN boundary, so the inter-VLAN firewall never saw it

Intra-VLAN traffic does not cross boundaries. Inter-VLAN firewalls only see traffic crossing between VLANs. The attacker was inside VLAN 30.

(A) Firewall was operational; traffic never reached it.

(B) Rule ordering is irrelevant — traffic never entered the firewall.

(C) DENY rules work on all traffic that reaches the firewall.

Exam Tip: Inter-VLAN firewalls only inspect boundary-crossing traffic. VLAN hopping bypasses them by placing the attacker inside the target VLAN. Prevention is at the switch port level.

Q8 Scenario B (Q8)

The attacker logs into the ATM console with admin/admin. The root cause is:

(A) A software vulnerability allowing authentication bypass (B) A brute-force attack using a dictionary over several hours (C) Default credentials (admin/admin) never changed during deployment — the first thing any attacker tries (D) The console does not support authentication

admin/admin = factory defaults published in product manuals. Attackers try defaults first — zero skill required.

(A) No vulnerability needed; valid (default) credentials used.

(B) No brute-force needed; default password worked immediately.

(D) The console supports auth; it was using defaults.

Exam Tip: Default credentials = #1 pen test finding. Change ALL defaults before deployment.

Q9 Scenario B (Q9)

Which fix addresses the root cause of the VLAN hopping?

(A) Configure ALL user-facing ports as access ports with specific VLAN assignments and disable DTP — prevents trunk negotiation on any user port (B) Add more firewall rules to block VLAN 30 traffic from lobby IPs (C) Install a camera in the lobby to observe the Ethernet jacks (D) Change the ATM console password to something stronger

Root cause = trunk port on a user jack. Fix = access mode + DTP disabled on all user ports. Firewall rules (B) are irrelevant — VLAN hopping bypasses them. Camera (C) is detective. Password (D) is a different finding.

(B) VLAN hopping bypasses inter-VLAN firewalls.

(C) Cameras detect after; access ports prevent.

(D) Password addresses default credentials, not VLAN hopping.

Exam Tip: Root cause analysis: VLAN hopping = trunk port misconfiguration. Fix the port, not the downstream symptoms.

Q10 Scenario B (Q10)

Which combination of switch hardening measures prevents VLAN hopping?

(A) Trunk mode + DTP enabled + port mirroring (B) Access mode only — DTP and BPDU Guard unnecessary (C) Shut down unused ports but leave active ports as trunk for flexibility (D) Access mode + DTP disabled + BPDU Guard — prevents trunk negotiation and auto-disables ports receiving unexpected control frames

Complete port hardening: access mode, DTP disabled, BPDU Guard. All three together. Access mode alone (B) can be overridden if DTP is active.

(A) Trunk + DTP enabled = the vulnerable configuration.

(B) Access alone is insufficient; DTP can override.

(C) Trunk on active ports recreates the vulnerability.

Exam Tip: Port hardening: (1) access mode, (2) DTP disabled, (3) BPDU Guard, (4) unused ports shut down. Apply to EVERY switch.

Q11 Scenario C — Meridian Protocol Exploit (Q11)

Scenario C: Meridian Energy Grid — An audit finds: (1) Telnet with root on SCADA servers, (2) FTP for firmware, (3) HTTP on billing portal, (4) unencrypted Modbus to substations.

Which finding should be fixed FIRST?

(A) HTTP on billing — customer-facing is highest priority (B) FTP for firmware — integrity is critical (C) Telnet with root on SCADA — plaintext root access to power grid controllers = maximum physical safety risk with zero skill required (D) Unencrypted Modbus — oldest protocol first

Telnet + root + SCADA = highest risk. Maximum privilege, maximum impact, maximum exposure, minimum skill.

(A) Billing is serious but lower impact than SCADA.

(B) Firmware integrity is important but requires more steps to exploit than Telnet root.

(D) Age does not determine priority; impact does.

Exam Tip: Priority = impact × privilege × ease. SCADA always outranks corporate systems.

Q12 Scenario C (Q12)

If SSH replaced Telnet, what would an interceptor see?

(A) The same data — SSH and Telnet are identical (B) Encrypted data that is unreadable — SSH encrypts the entire session (C) Only the commands but not the password (D) An error message detecting the interception

SSH encrypts everything: credentials, commands, output, file transfers. Interceptor sees encrypted bytes.

(A) SSH and Telnet have fundamentally different security.

(C) SSH encrypts the entire session, not selectively.

(D) SSH does not inherently detect all interception scenarios.

Exam Tip: SSH encrypts EVERYTHING. Telnet sends EVERYTHING in plaintext. The difference is total.

Q13 Scenario C (Q13)

SSL stripping is demonstrated on the billing portal. What defense eliminates this vulnerability?

(A) HSTS preloading — browser hardcodes HTTPS for this domain, eliminating the initial HTTP request that SSL stripping intercepts (B) A stronger TLS certificate with longer key length (C) Disabling HTTP port 80 entirely on the server (D) Adding a second HTTPS redirect after the first

HSTS preloading eliminates the HTTP moment SSL stripping exploits. Browser never sends HTTP.

(B) Key length does not affect SSL stripping; it targets the redirect.

(C) Disabling port 80 helps but browser may still try HTTP first.

(D) Second redirect still travels over HTTP and can be stripped.

Exam Tip: SSL stripping exploits the HTTP redirect. HSTS eliminates the redirect. Preloading hardcodes it permanently.

Q14 Scenario C (Q14)

What does DNSSEC provide that standard DNS does NOT?

(A) Encryption of DNS queries preventing eavesdropping (B) Automatic blocking of malicious domains (C) Faster resolution via browser caching (D) Cryptographic signatures on responses verifying they are authentic and unmodified — preventing DNS spoofing

DNSSEC signs responses. Resolver verifies: genuine server + unmodified response. Does NOT encrypt queries (DoH/DoT does that).

(A) DNSSEC = authentication/integrity, NOT encryption.

(B) DNSSEC verifies; it does not block.

(C) DNSSEC does not affect resolution speed.

Exam Tip: DNSSEC = auth + integrity. DoH/DoT = encryption. Different problems, different solutions. Use both.

Q15 Scenario C (Q15)

Which migration priority order is correct?

(A) HTTP→HTTPS first, then FTP→SFTP, then Telnet→SSH, then Modbus (B) Telnet→SSH on SCADA first (highest impact), then HTTP→HTTPS+HSTS (customer data), then FTP→SFTP (firmware), then Modbus (requires OT testing) (C) Modbus first (oldest protocol), then everything else simultaneously (D) All four simultaneously on the same day for maximum efficiency

Priority: SCADA (highest impact) → billing (customer-facing) → firmware (integrity) → Modbus (OT requires careful testing).

(A) SCADA must come before customer-facing.

(C) Age does not determine priority.

(D) Simultaneous is reckless — cannot isolate failures.

Exam Tip: Migration priority: impact × ease of exploit. SCADA first, customer-facing second, internal third, OT last (testing required).

Questions Correct

Unit 3 Project → Course Hub

← Course Hub Unit 3 Project →

AP Cybersecurity Unit 3 • Scenario Practice | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]