AP Cybersecurity Unit 4 Exam: Securing Devices

AP Cybersecurity › Unit 4: Securing Devices › Final Exam

Unit 4 — Securing Devices · Final Exam

Unit 4 Exam: Securing Devices

20 Questions · All Five Lessons · 25–35 min · Instant feedback

🎯 Instructions

20 multiple-choice questions spanning all five lessons in Unit 4 (four questions per lesson).
Click Check Answer after each question to see feedback.
Your total score and a per-lesson breakdown appear at the bottom once you’ve answered all 20.
Target: 16 of 20 (80%) or better. Below 14 of 20, revisit the weakest lessons before the real AP exam.

00:00

📑 Exam Coverage

4.1 Device Types and Vulnerabilities (Q1–Q4) · 4.2 Malware (Q5–Q8) · 4.3 Authentication and Access Control (Q9–Q12) · 4.4 Device Hardening and Configuration (Q13–Q16) · 4.5 Securing IoT and Embedded Devices (Q17–Q20)

✎ Unit 4 Final Exam

Question 1 of 20 · Lesson 4.1 A hospital IT team is performing a risk audit on a 2010-era infusion pump. The vendor ended firmware support in 2017, yet the pump is still clinically certified for use through 2032. Which characteristic BEST explains why this device is structurally harder to secure than a standard employee laptop?

(A) The pump processes more data per minute than a typical laptop.
(B) Infusion pumps are always faster than laptops, which reduces scan time.
(C) The combination of long lifecycle plus no remaining patch channel means any newly discovered vulnerability is permanent for the rest of the device’s service life.
(D) The pump connects via Wi-Fi, which is inherently less secure than wired Ethernet in every case.

Question 2 of 20 · Lesson 4.1 In 2017, a North American casino was breached through a smart thermometer in its lobby aquarium. Which single architectural decision MOST directly enabled the attackers to pivot from the thermometer to the customer database?

(A) The thermometer was on the same flat network as valuable internal systems, with no network segmentation between them.
(B) The aquarium was in a lobby with public foot traffic.
(C) The thermometer ran on battery power instead of wall power.
(D) The casino used an off-brand thermometer instead of the industry-standard product.

Question 3 of 20 · Lesson 4.1 A security team is categorizing devices for policy purposes. Which of the following is BEST classified as an embedded system rather than an IoT device?

(A) A smart refrigerator that reports inventory to a mobile app.
(B) A Wi-Fi thermostat a homeowner controls remotely.
(C) A networked smart security camera sold to consumers.
(D) An industrial programmable logic controller (PLC) running a single dedicated function inside a factory for 25 years.

Question 4 of 20 · Lesson 4.1 All of the following are common device vulnerabilities from Lesson 4.1 EXCEPT:

(A) Default and weak credentials shipped from the factory.
(B) A device that auto-installs every signed vendor patch within 24 hours of release.
(C) Unnecessary open ports and services enabled by default.
(D) Physical vulnerability of a device installed in an unmonitored public space.

Question 5 of 20 · Lesson 4.2 A home router is compromised. The owner notices no unusual behavior, but their ISP sends an abuse notice because the router is simultaneously flooding traffic at third-party banking sites as part of a coordinated denial-of-service attack. Which malware category BEST fits?

(A) Spyware — the malware is silently monitoring user activity.
(B) Ransomware — the attacker is extorting the third-party banks.
(C) Trojan — the router was installed as a disguised program.
(D) Botnet agent — the router participates in coordinated attacks on other targets with no visible local impact.

Question 6 of 20 · Lesson 4.2 Consider the following statements about detection approaches.
I. Signature-based detection is effective against known malware but not against brand-new variants.
II. Behavioral detection is blind to fileless attacks because fileless malware does not touch disk.
III. Sandbox analysis detonates suspicious files in an isolated VM to observe behavior.
Which statement(s) are TRUE?

(A) II only
(B) II and III only
(C) I and III only
(D) I, II, and III

Question 7 of 20 · Lesson 4.2 A security operations center analyst observes malware that: (1) spread across 200+ workstations in 30 minutes, (2) required no user action or email click to propagate, and (3) exploited an unpatched SMB service. Which malware category BEST matches these observations?

(A) Worm — self-replicating malware that spreads automatically across networks with no user interaction.
(B) Trojan — disguised as a legitimate program the user voluntarily installs.
(C) Adware — aggressively displays unwanted advertising.
(D) Rootkit — hides itself at the kernel level.

Question 8 of 20 · Lesson 4.2 An attacker compromises a trusted software vendor and plants malicious code inside an otherwise legitimate product update. Every organization that installs the update is compromised — including organizations that verify the vendor’s digital signature, because the attacker has access to the signing infrastructure. What delivery pattern does this BEST describe?

(A) Phishing email — the update arrived via email.
(B) Supply-chain attack — malicious code was injected into a trusted upstream software distribution, so signed updates carry the malware.
(C) Drive-by download — visitors to compromised sites triggered the attack.
(D) Infected removable media — the update was distributed on USB drives.

Question 9 of 20 · Lesson 4.3 Which of the following combinations is TRUE multi-factor authentication?

(A) A password plus a four-digit account PIN.
(B) Two different passwords, one for logging in and one for administrative commands.
(C) A password plus a fingerprint scan.
(D) A security question plus a recovery email address.

Question 10 of 20 · Lesson 4.3 A large hospital uses role-based access control (RBAC). Over time, the “Registered Nurse” role has accumulated 130+ distinct permissions. A new patient-portal feature only requires 2 of those permissions. The organization is experiencing which RBAC anti-pattern, and what is the correct fix?

(A) “Role starvation” — merge more roles together.
(B) “Role orphaning” — delete the role entirely.
(C) “Role tunneling” — redirect permissions through other roles.
(D) “Role explosion” — decompose the mega-role into narrower function-specific sub-roles and assign only the sub-roles each nurse actually needs.

Question 11 of 20 · Lesson 4.3 A procurement system requires that one employee submit a purchase order and a different employee approve it before funds are released. This design PRIMARILY implements which security principle?

(A) Defense in depth.
(B) Separation of duties.
(C) Principle of least privilege.
(D) Non-repudiation.

Question 12 of 20 · Lesson 4.3 A user is phished via a convincing fake login page. The page is actually a real-time proxy that forwards the password to the real site, prompts for the user’s TOTP code, forwards that too, and captures the resulting session cookie. Which statement BEST explains why the user’s MFA did not stop this?

(A) TOTP codes are phishable because a user can type them into any site, so a real-time phishing proxy can relay them to the legitimate service and then steal the authenticated session.
(B) The user had a weak password; MFA only works with strong passwords.
(C) MFA does not work against any form of phishing, so it should never be deployed.
(D) The user should have used SMS instead of TOTP, which would have blocked the proxy.

Question 13 of 20 · Lesson 4.4 An organization discovers that its file server is missing 18 months of OS security updates. All of the following are reasonable responses to this specific gap EXCEPT:

(A) Apply the outstanding security updates during a scheduled maintenance window.
(B) Enroll the server in an automated patch-management system with a defined SLA.
(C) Review the change-management history to understand why updates were skipped.
(D) Disable the built-in guest account and rotate local administrator passwords.

Question 14 of 20 · Lesson 4.4 A small private-sector company with no government contracts wants a well-respected, free reference baseline for hardening its Windows and Linux servers. Which baseline is the BEST fit?

(A) DISA STIGs — the standard for all companies as well as DoD.
(B) FedRAMP — a per-device configuration baseline.
(C) CIS Benchmarks — free, consensus-driven, with Level 1 and Level 2 tiers sized for private-sector use.
(D) NIST 800-53 — a per-device hardening checklist.

Question 15 of 20 · Lesson 4.4 A server was fully CIS L2 hardened when deployed in 2022. An audit today shows many original hardening settings have been undone, new test accounts exist, and logging agents are disabled — none of which appears in the formal change history. What has happened to this server?

(A) Configuration drift — the live state has diverged from the documented baseline through many small undocumented changes.
(B) Zero-day vulnerability — a newly disclosed flaw was not patched.
(C) Defense in depth — additional controls were layered on top.
(D) Separation of duties — multiple administrators split the changes between them.

Question 16 of 20 · Lesson 4.4 A company allows BYOD. An employee needs access to corporate email and a CRM app on her personal iPhone, but she refuses to enroll the phone in full MDM because it would give IT visibility into her personal photos, messages, and apps. Legal counsel supports the privacy objection. Which approach BEST satisfies both the security need and the privacy requirement?

(A) Require full MDM; privacy is not a legitimate objection under BYOD.
(B) Deploy Mobile Application Management (MAM) so IT manages only the corporate apps (email, CRM) while the personal side of the device remains under the employee’s control.
(C) Deny BYOD access entirely; require the employee to use only corporate laptops.
(D) Issue a second company-owned phone to the employee.

Question 17 of 20 · Lesson 4.5 A pediatric ICU uses 80 bedside vital-signs monitors running an embedded OS. The manufacturer stopped shipping firmware updates in 2019, but the devices are FDA-cleared through 2031 and replacement would cost millions plus require recertification. Which defense provides the BEST risk reduction for the remaining service life?

(A) Install traditional antivirus on each monitor.
(B) Require nurses to reboot monitors weekly.
(C) Enforce password complexity on monitor admin interfaces.
(D) Place the monitors on a dedicated clinical-device VLAN with strict firewall rules, deny-by-default outbound policy, and no direct routing to sensitive systems.

Question 18 of 20 · Lesson 4.5 A logistics company is deploying 12,000 GPS trackers across its truck fleet. The security team wants trucker-tracker authentication to the cloud platform that does NOT rely on a shared secret printed in manuals. Which authentication approach scales BEST to 12,000 devices?

(A) Provision each tracker with a unique cryptographic certificate from a PKI; the cloud verifies the certificate at connection time and compromised trackers can be revoked individually.
(B) Issue all trackers a shared API key embedded in firmware.
(C) Require drivers to type a shared password on each tracker at the start of every shift.
(D) Trust any tracker connecting from a known cellular carrier IP range.

Question 19 of 20 · Lesson 4.5 A manufacturer wants to prevent an attacker from pushing tampered firmware to its industrial controllers, even if the attacker can intercept the update in transit. The boot chain must reject unsigned or modified code. Which combination BEST addresses this?

(A) Run updates over a VPN tunnel, which guarantees the integrity of transferred files.
(B) Sign firmware images with the manufacturer’s private key, and have each controller run secure boot that cryptographically verifies the signature at each boot stage before passing control.
(C) Use obscure proprietary firmware formats so attackers cannot construct replacement images.
(D) Push updates only during off-hours when no attackers are online.

Question 20 of 20 · Lesson 4.5 A security auditor asks a manufacturing firm to produce an authoritative list of every IoT device it owns, including each device’s firmware version, owner, network segment, and planned replacement date. The firm cannot. Which fundamental IoT security practice is missing?

(A) Mobile Application Management (MAM).
(B) Real-time antivirus scanning on every device.
(C) Device inventory and lifecycle management.
(D) Air-gapping.

0 / 20 0% Exam complete. Review any missed questions above.

← Review Lesson 4.5 Back to Unit 4 Hub

Free Tool

AP Cybersecurity Score Calculator

Enter your MCQ and FRQ raw scores to instantly see your predicted AP grade (1–5) with personalized study tips.

Calculate My Score →

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]