AP Cybersecurity 4.1 Exercise 1: Identify the Threat

Lesson 4.1 — Device Vulnerabilities & Attacks · Exercise 1 of 2

Exercise 1: Identify the Threat

Predict-first · 5 scenarios · Identify type, vector & device · 20–25 min

🎯 How to Use This Exercise

For each scenario, write your one-line prediction in the Predict First box before reading the options — commit to an answer based on the observed behavior, then check your reasoning.

Goal: 4 of 5. These map to LO 4.1.A–C (device types, malware types, exploitation vectors).

✎ Identify the Threat
Scenario 1 of 5 — Device Type An employee loses a battery-powered device at an airport. It holds the company MFA authenticator app, saved Wi-Fi credentials, and recent location history. Under the CED device taxonomy, what type is it, and why does the loss matter most?
Predict First In one sentence, which device type is this and why?
Scenario 2 of 5 — Malware Type Files across a workstation are renamed with a new extension, a note in every folder demands cryptocurrency within 48 hours, and weekend logs show a process that spent hours encrypting files. Which malware type is this?
Predict First Name the malware type and the single strongest clue.
Scenario 3 of 5 — Exploitation Vector An adversary finds an unattended laptop, boots it into recovery mode, and gains elevated access without ever logging into the OS. Which CED exploitation vector does this exploit, and what is the matching defense?
Predict First Which vector is being exploited, and what stops it?
Scenario 4 of 5 — Multi-Select (Select ALL vectors) Which of the following are device exploitation vectors named in the CED? Select ALL that apply. No credit for selecting incorrect options.
Predict First Without looking, name two ways an adversary exploits a device.
Scenario 5 of 5 — Malware Type A workstation shows malicious activity running entirely in memory through the system’s own PowerShell. No files are on disk and a signature scan is clean. Which malware type, and why does signature-based anti-malware miss it?
Predict First What type leaves no file, and why does that matter?
0 / 5 4+/5 means you can move on to Exercise 2.
← Back to Lesson Next: Exercise 2 →
AP Cybersecurity · Unit 4 · Lesson 4.1 · Exercise 1
Lesson•Exercise 1••Lab•Quiz
Back to:Lesson 4.1Unit 4 Study GuideCourse Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours
✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

✉

Email

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]