AP Cybersecurity Unit 5 Exam: Securing Applications & Data

AP Cybersecurity › Unit 5: Securing Applications & Data › Final Exam

Unit 5 — Securing Applications & Data · Final Exam

Unit 5 Exam: Securing Applications & Data

20 Questions · All Six Lessons · 25–35 min · Instant feedback

Instructions

20 multiple-choice questions spanning all six lessons in Unit 5 (3 or 4 questions per lesson).
Click Check Answer after each question to see feedback.
Your total score and a per-lesson breakdown appear at the bottom once you have answered all 20.
Target: 16 of 20 (80%) or better. Below 14 of 20, revisit the weakest lessons before the real AP exam.

00:00

Exam Coverage

5.1 Application & Data Vulnerabilities (Q1–Q3) · 5.2 Symmetric Cryptography (Q4–Q7) · 5.3 Hashing for Data Integrity (Q8–Q10) · 5.4 Asymmetric Cryptography & PKI (Q11–Q14) · 5.5 Protecting Applications (Q15–Q17) · 5.6 Detecting Attacks on Data & Applications (Q18–Q20)

Unit 5 Final Exam

Question 1 of 20 · Lesson 5.1 A developer is reviewing the following server-side handler for a public login form:

def authenticate(username, password):
    sql = "SELECT id FROM users WHERE name='" + username + "'"
    row = db.execute(sql).fetchone()
    if row and verify_hash(password, row.pw_hash):
        return row.id
    return None

Which single statement BEST identifies the most severe vulnerability in this code?

(A) The password is compared using a hash verification function, so plaintext passwords could be stored if verify_hash is misused.
(B) The function returns None on failure, which may leak information to an attacker about whether the username exists.
(C) The username is concatenated directly into the SQL query string, enabling an attacker to inject SQL statements such as ' OR '1'='1 to bypass authentication entirely.
(D) The database execution does not use a transaction, which could cause race conditions under high concurrent load.

Question 2 of 20 · Lesson 5.1 A web application displays user-submitted comments directly in the HTML of a public page without any output encoding. Three potential attacks are listed below:

I. An attacker posts a comment containing that executes when any visitor loads the page.
II. An attacker crafts a link containing JavaScript in a URL parameter; users who click it from a phishing email run the script in the context of the vulnerable site.
III. An attacker brute-forces the application's administrator login via repeated HTTP POST requests.

Which of these attacks does the described vulnerability (missing output encoding) ENABLE?

(A) I and II only
(B) II and III only
(C) I and III only
(D) I, II, and III

Question 3 of 20 · Lesson 5.1 All of the following are examples of attacks that primarily violate the confidentiality property of the CIA triad EXCEPT which one?

(A) An attacker eavesdrops on an unencrypted Wi-Fi network and captures login credentials transmitted in cleartext.
(B) A malicious insider copies a customer database to a personal USB drive and sells the records on a dark-web marketplace.
(C) An attacker exploits an improperly secured cloud storage bucket to download terabytes of private medical records.
(D) An attacker floods a hospital's patient-portal server with traffic, making it unreachable for legitimate users during a medical emergency.

Question 4 of 20 · Lesson 5.2 Which of the following BEST describes a defining property of AES-256 that distinguishes it from older symmetric ciphers such as DES?

(A) AES-256 is an asymmetric cipher that uses a different key for encryption and decryption, providing stronger key management.
(B) AES-256 uses a 256-bit key and a block size of 128 bits, providing a brute-force keyspace far beyond what is computationally feasible to exhaust on current hardware.
(C) AES-256 stores its encryption key inside the ciphertext itself, so the recipient does not need to establish a shared secret in advance.
(D) AES-256 produces a ciphertext that is always shorter than the plaintext, which improves transmission efficiency on slow networks.

Question 5 of 20 · Lesson 5.2 A junior developer writes the following routine to encrypt each record in a database using AES in CBC mode:

const KEY = loadSecretKey();
const IV  = Buffer.alloc(16, 0);   // all zeros, reused for every record

function encryptRecord(plaintext) {
    const cipher = crypto.createCipheriv('aes-256-cbc', KEY, IV);
    return Buffer.concat([cipher.update(plaintext), cipher.final()]);
}

Which of the following BEST describes the most serious cryptographic flaw in this implementation?

(A) The key is loaded at module import rather than per-request, which creates a timing side channel that leaks bits of the key.
(B) AES-CBC has been deprecated in favor of AES-ECB for database encryption because ECB is more performant on short plaintext values.
(C) The Buffer.concat call copies the ciphertext, doubling memory usage per encryption and creating a denial-of-service risk.
(D) The IV (initialization vector) is a constant all-zeros value, so identical plaintexts always produce identical ciphertexts — an attacker who can submit chosen plaintexts can test whether any record contains a target value.

Question 6 of 20 · Lesson 5.2 Two systems need to exchange encrypted messages using AES. Before they can do so, they must first share the AES key securely. Which of the following accurately describes the central challenge that symmetric cryptography alone cannot solve?

(A) The two systems must somehow agree on the same secret key without an eavesdropper intercepting it, but symmetric cryptography by definition requires both parties to already share the secret, creating a chicken-and-egg problem for initial key exchange over an insecure channel.
(B) AES keys must be exactly 256 bits long, which is technically difficult for most systems to generate and store reliably.
(C) Symmetric encryption is too slow for real-world network traffic, so keys must be exchanged over a separate slower channel than the data they protect.
(D) Modern operating systems do not allow user-space applications to access cryptographic keys, so keys must be physically typed in at the keyboard on both ends.

Question 7 of 20 · Lesson 5.2 All of the following are legitimate practices for using AES encryption in a production application EXCEPT which one?

(A) Use a fresh, randomly-generated IV for every encryption operation, and store or transmit the IV alongside the ciphertext.
(B) Rotate the AES encryption key on a scheduled interval and re-encrypt affected data under the new key.
(C) Hard-code the AES key as a string constant in the application source code so it is always available to the binary at runtime.
(D) Derive the AES key from a password using a slow key-derivation function such as PBKDF2, Argon2, or scrypt, rather than using the password directly as the key.

Question 8 of 20 · Lesson 5.3 Which of the following statements MOST ACCURATELY describes the difference between cryptographic hashing and encryption?

(A) Hashing and encryption are the same operation; the terms are used interchangeably in professional security work.
(B) Hashing uses a secret key and encryption does not, which is why encrypted data is reversible and hashed data is not.
(C) Encryption produces a fixed-length output regardless of input size, while hashing produces a variable-length output depending on the key.
(D) Encryption is designed to be reversible by anyone holding the correct key, while cryptographic hashing is a one-way function that produces a fixed-length output and cannot be reversed to recover the original input.

Question 9 of 20 · Lesson 5.3 A web application team is redesigning its password storage system. Which of the following approaches provides the STRONGEST protection against offline password-guessing attacks if the password database is stolen?

(A) Store passwords encrypted with AES-256 using a key stored in the same database, so they can be decrypted for verification.
(B) Store passwords as a salted hash generated with a slow password-hashing function such as Argon2id, bcrypt, or scrypt, with a unique random salt per user.
(C) Store passwords as an MD5 hash without salt, since MD5 is fast and produces a fixed-length output.
(D) Store passwords in plaintext but restrict database access to application servers only, on the theory that the perimeter firewall is the primary control.

Question 10 of 20 · Lesson 5.3 A file download page publishes the SHA-256 hash of an installer so users can verify the file has not been tampered with. This use case depends primarily on which cryptographic property of SHA-256?

(A) Collision resistance — it is computationally infeasible for an attacker to produce two different files that hash to the same SHA-256 value, so a matching published hash indicates the file is the same one the publisher intended.
(B) Key secrecy — the hashing algorithm requires a secret key known only to the publisher, so only they can produce a valid hash.
(C) Encryption strength — SHA-256 encrypts the file so that only users with the correct download key can recover the plaintext installer.
(D) Randomness — SHA-256 produces a random value each time it is computed, which provides a unique session identifier for each download.

Question 11 of 20 · Lesson 5.4 Alice wants to send Bob a message that only Bob can read. Using asymmetric cryptography, which key is used to encrypt the message, and which key is used to decrypt it?

(A) Encrypt with Alice's private key; decrypt with Alice's public key.
(B) Encrypt with Bob's private key; decrypt with Bob's public key.
(C) Encrypt with Bob's public key; decrypt with Bob's private key.
(D) Encrypt with Alice's public key; decrypt with Bob's private key.

Question 12 of 20 · Lesson 5.4 A software vendor publishes a driver update accompanied by a digital signature produced using the vendor's private key. A user's operating system verifies the signature using the vendor's public key (obtained from a trusted certificate). If the signature verifies successfully, what specific claim can the user reasonably make about the update?

(A) The driver file is encrypted so that only this user's computer can execute it.
(B) The driver originated from the entity that controls the private key matching the verified certificate (authenticity), and it has not been modified since it was signed (integrity).
(C) The driver has been scanned by antivirus software and is guaranteed to contain no malicious code.
(D) The driver will function correctly on the user's specific hardware configuration without causing a crash.

Question 13 of 20 · Lesson 5.4 Three students discuss how a web browser decides to trust a server's TLS certificate:

I. The browser verifies that the certificate was signed by a Certificate Authority (CA) whose root certificate is already installed in the browser's trust store.
II. The browser performs a DNS lookup to verify that the certificate's listed hostname resolves to the same IP address as the server presenting the certificate.
III. The browser checks that the certificate has not expired and has not been revoked.

Which of these statements accurately describe steps that a modern browser performs during TLS certificate validation?

(A) I only
(B) II only
(C) I and II only
(D) I and III only

Question 14 of 20 · Lesson 5.4 Modern secure protocols such as TLS typically combine asymmetric and symmetric cryptography in a hybrid scheme. Which of the following BEST explains the motivation for this design?

(A) Asymmetric cryptography is well-suited for establishing a shared secret over an insecure channel but is computationally expensive for bulk data. Symmetric cryptography is fast but requires a shared secret. Hybrid designs use asymmetric operations once to exchange a symmetric key, then use symmetric encryption for the session data.
(B) Asymmetric cryptography produces shorter ciphertexts than symmetric cryptography, so hybrid schemes are preferred for bandwidth-constrained applications.
(C) Symmetric cryptography can only be used for authentication, not confidentiality, so hybrid schemes add asymmetric encryption to provide the confidentiality property.
(D) Asymmetric and symmetric cryptography are mathematically incompatible, so hybrid schemes rely on a third kind of cryptography that combines features of both.

Question 15 of 20 · Lesson 5.5 A development team protects their web application from SQL injection by only validating inputs in client-side JavaScript before submitting the form. Which of the following BEST describes why this approach is inadequate?

(A) Client-side JavaScript runs faster than server-side code, which causes validation to complete before the server has time to apply its own checks.
(B) An attacker can trivially bypass client-side validation by sending requests directly to the server using tools such as curl or a browser developer console, since the attacker controls what runs in their own browser.
(C) Client-side JavaScript is written in a different language than the server, which creates subtle mismatches in how strings are handled.
(D) Client-side validation is never performed in modern browsers because of privacy regulations.

Question 16 of 20 · Lesson 5.5 A web application's back-end connects to a PostgreSQL database using a single database user account that has been granted ALL PRIVILEGES on every table, including administrative permissions to create and drop tables. Which of the following principles is MOST DIRECTLY violated by this configuration?

(A) Defense in depth — the application has only one layer of security against database attacks.
(B) Separation of duties — one developer has too much control over the database schema.
(C) Principle of least privilege — the application account holds far more permissions than it needs to perform its function, so an attacker who compromises the application inherits full database administrative access.
(D) Fail-secure design — the database should fail to a closed state when permissions are misconfigured.

Question 17 of 20 · Lesson 5.5 A security audit of a production web application finds that the server is running a version of a popular open-source library with a publicly disclosed CVE rated Critical. The patched version has been available for 90 days. Which of the following is the MOST APPROPRIATE immediate response?

(A) Test the patched version of the library in a staging environment, deploy to production as an expedited change on an accelerated timeline, and document the delayed patching as a finding for the team's process-improvement review.
(B) Leave the current version in place because a 90-day lag is within industry norms and rushing patches can introduce regressions.
(C) Remove the library from the application entirely and rewrite its functionality in-house to avoid relying on third-party code in the future.
(D) Block access to the application at the perimeter firewall until a full security audit of every dependency has been completed, which typically takes several months.

Question 18 of 20 · Lesson 5.6 Following the NIST SP 800-61 incident-response lifecycle, which of the following sequences is the CORRECT ordering of phases after initial detection?

(A) Detection & Analysis → Recovery → Containment → Eradication → Lessons Learned
(B) Detection & Analysis → Eradication → Containment → Recovery → Lessons Learned
(C) Detection & Analysis → Containment → Recovery → Eradication → Lessons Learned
(D) Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned

Question 19 of 20 · Lesson 5.6 A threat-intelligence team is evaluating which indicator to promote into a long-lived detection rule. According to the Pyramid of Pain, which indicator, if detected reliably, forces an attacker into the MOST EXPENSIVE response to evade the detection?

(A) The SHA-256 hash of a specific malware binary observed in a past campaign.
(B) A detection rule for a tactic, technique, or procedure (TTP) — for example, "PowerShell invoked with the -enc flag to run a base64-encoded payload retrieved from a network source."
(C) The IP address of a known command-and-control server from a recent campaign.
(D) The specific domain name registered by the attacker to host malware.

Question 20 of 20 · Lesson 5.6 All of the following are legitimate benefits of a SIEM correlation rule that joins events across multiple log sources EXCEPT which one?

(A) Joining two weak individual signals into a stronger composite signal reduces false-positive rate without sacrificing detection coverage.
(B) Cross-source correlation enables kill-chain detections (for example, authentication plus process creation plus outbound network egress) that no single log source can see alone.
(C) A correlation rule that requires two signals in a time window guarantees that any alert it fires represents a true compromise, so analyst investigation becomes optional.
(D) Combining what would otherwise be many individual alerts into a smaller number of higher-quality alerts reduces analyst alert-fatigue and raises the likelihood that each fired alert is investigated thoroughly.

0 / 20 0% Exam complete. Review any missed questions above.

← Review Lesson 5.6 Back to Unit 5 Hub

Free Tool

AP Cybersecurity Score Calculator

Enter your MCQ and FRQ raw scores to instantly see your predicted AP grade (1–5) with personalized study tips.

Calculate My Score →

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]