Five exam-format questions across all L5.5 topics: defense in depth, secure coding, input validation, output encoding, authentication and session controls, CSP, WAF, and rate limiting. Mix of spot-the-error, I/II/III multi-correct, and scenario-based stems — exactly the formats you will see on the AP exam.
5 Questions~12 minExam Format
How to Approach These
1. Identify the OWASP category from the stem before reading options.
2. For I/II/III questions, evaluate each statement independently. Do not anchor on the first true statement.
3. For code questions, trace what happens line by line. Look for trusted-input-into-interpreter patterns, denylist filters, and fail-open logic.
4. Prefer root-cause controls over compensating controls. Parameterized queries, MFA, encoding, and session regeneration beat WAFs, CAPTCHAs, and signature-based filters.
Score0 / 5
Question 1
Examine this authentication check. Assume verify_password returns True when the submitted password matches the stored bcrypt hash.
def login(request): email = request.form['email'] pw = request.form['password'] user = User.find_by_email(email) if user is None: return error("No account with that email") if not verify_password(pw, user.pw_hash): return error("Wrong password") login_user(user) return redirect("/dashboard")
Which security issue is most significant?
Question 2
Which of the following statements about input validation are correct?
I. Allowlist validation (specify what is acceptable) is structurally stronger than denylist validation (specify what is forbidden). II. Client-side input validation is sufficient as long as the client is a modern browser with JavaScript enabled. III. Input validation should be performed at the server, at the point where the data crosses into business logic. IV. Input validation and output encoding address the same failure and only one is needed.
Question 3
A developer inherits a web application with the following security posture: HTTPS everywhere, bcrypt password hashing, HttpOnly and Secure cookie flags, and server-side input validation. The site recently suffered a successful Cross-Site Request Forgery (CSRF) attack that transferred funds from users' accounts. Given this baseline, which single additional control is the best primary CSRF defense?
Question 4
Which of the following are true about Content Security Policy (CSP)?
I. A strict CSP can prevent injected scripts from executing even if XSS injection succeeds. II. Adding unsafe-inline to script-src is required for most modern applications and does not weaken CSP. III. CSP is browser-enforced; the policy has no effect if the browser ignores it. IV. CSP directives like connect-src can limit where a page may fetch() data to, mitigating some XSS-driven exfiltration.
Question 5
A SaaS platform receives complaints that password-reset emails are flooding inboxes — a user reports 47 reset emails arrived at their address in 2 minutes. Investigation finds that an attacker can trigger a password-reset email by submitting the user's email address; there is no rate limit. The attacker is using this to harass a specific user. What is the best immediate control?
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed.
Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Typically responds within 24 hours
✓
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
34.8% of Tanner’s CSP students score 5s. The national average is 9.6%.
I’m a Student
I’m a Teacher
✓Free AP CSP Big Ideas cheat sheet (PDF)
✓Daily practice questions covering all 5 Big Ideas
✓Create Task tips that actually work — from a real AP teacher
✓Free class codes with student progress tracking
✓3 full practice exams + Top 100 questions for your class
✓Create Task guidance and pseudocode reference sheets
Which AP CS exams are you prepping for?
✓
You’re in!
Your Big Ideas cheat sheet is on its way.
No thanks, I’ll figure it out myself
Avg student improvement: 2+ score levels | Real AP teacher, not just a tutor
AP Cybersecurity — National Launch 2026–27
Get Early Access to AP Cyber
AP Cyber launches nationally fall 2026. Get in early to help shape the course — start free with Unit 1 and the free teacher gradebook.
✓
You’re in — you’re on the AP Cyber early-access list!
Tanner will follow up personally within 48 hours. Your feedback will directly shape what gets built.
Step 1 of 4
Early Access — Limited Spots
Who are you?
Are you a teacher or a student?
I’m a Teacher
I’m a Student
Free to start — Unit 1 and the teacher gradebook are always free, no credit card.
Founding teachers unlock all 5 units and get direct input on what we build.
Not interested right now
Step 2 of 4
Your School
Tell us about your class
Other AP CS courses you teach
Your Situation
Tell us about yourself
Step 3 of 4
Classroom Needs
What does your classroom need? (select all that apply)
How You Study
What would help you most? (select all that apply)
Step 4 of 4
Almost Done
Where should we send your early-access details?
Free gradebook + Unit 1 | Your feedback shapes the course | Built by a real AP teacher