AP Cybersecurity Interactive Lab - Units 3 & 4

AP Cybersecurity · Hands-On Lab

SOC Operator: Network & Device Defense

A hands-on simulation for Unit 3 — Securing Networks and Unit 4 — Securing Devices. Scan a host, hunt indicators of compromise in real logs, build a firewall ACL, and capture three flags. No installs — everything runs in your browser.

Units 3 & 4 · CED-aligned · ~45–60 min

Points 0/ 100 Flags 0/ 3 Stations 0/ 5

01Port Mapping — Find the Rogue ServiceCED · IoC: mismatched port/service

Reconnaissance starts with knowing what's listening. You'll run a simulated nmap scan against a workstation your NIDS flagged, then decide which open port doesn't belong.

Mission: Scan host 10.10.20.5. One service is a network-based indicator of compromise — a program running on a port that doesn't match its expected service. Identify it.

analyst@soc: ~/recon

analyst@soc:~$

02Log Analysis — Hunt the Break-InCED · Detecting attacks / IoCs

A server's authentication log is below. Somewhere in the noise, an attacker brute-forced a login and got in.

Mission: Click every line that is part of the attack. You're looking for the brute-force attempts and the successful breach that follows. Select all the malicious lines, then submit.

💡 Need a hint?

A single failed login is normal. Look for the same source IP failing over and over in seconds against an invalid user — then watch that same IP suddenly get "Accepted." That transition from many failures to a success is the break-in.

03Packet Capture — Who Owns the Gateway?CED · On-path / ARP attacks

You pulled a short packet capture from the LAN. The gateway is 10.10.20.1. Inspect the ARP replies.

Mission: Read the capture, then identify the attack in progress.

#	Time	Protocol	Info

What attack does this capture show?

💡 Need a hint?

Two different MAC addresses are both claiming to be 10.10.20.1. When an attacker forges ARP replies so the gateway's IP maps to their MAC, traffic silently routes through them.

04Firewall Lab — Build the ACLCED · Firewalls / ACL order

A new public web server must be reachable on TCP 443 — but all other inbound TCP must be blocked. Firewalls read an access control list top-to-bottom and act on the first rule that matches.

Mission: Put the two rules in the correct order, then run the test traffic. Get all packets routed correctly (443 allowed, everything else blocked).

💡 Need a hint?

If DENY inbound TCP ALL sits first, it matches everything — including 443 — before the ALLOW rule is ever reached. The specific ALLOW must come before the broad DENY.

05Capture the Flag — Forensics SprintCED · Encoding / detection

Three artifacts, three hidden flags. Each flag looks like APCEP{...}. Use the decoder toolkit below — analysts decode data all day. Find each flag and submit it.

🔧 Analyst Decoder Toolkit

output appears here…

FLAG 1 Hidden in the access log ✓ Captured

An IDS logged an odd HTTP request. The attacker stuffed data into the User-Agent. It's Base64 — decode it.

203.0.113.66 - - [08/Oct/2026:02:14:55] "GET /status HTTP/1.1" 200 User-Agent: QVBDRVB7bjN0dzBya18xbnRydWQzcn0=

FLAG 2 The evil twin's calling card ✓ Captured

A wireless scan found a rogue access point mimicking the corporate SSID. Its vendor/info field carries a suspicious hex blob. Decode it.

SSID: CORP-WIFI BSSID: 0a:11:22:33:44:01 signal:-42 ENC: WPA2 (trusted) SSID: CORP-WIFI BSSID: de:ad:be:ef:12:99 signal:-39 ENC: OPEN info=41504345507b6576316c5f7477316e7d

FLAG 3 The weak router config ✓ Captured

A router backup uses a broken wireless cipher. A technician hid a note on the same line — but typed it backwards. Reverse it.

! router-config r3-lobby interface wlan0 encryption mode wep key 0 1234567890 ! NOTE: }n3k0rb_s1_p3w{PECPA

🏆 Mission Complete

—

You scanned a host, traced a live break-in, unmasked an ARP on-path attacker, hardened a firewall, and captured all three flags. That's the full Unit 3–4 defender workflow — hands-on.

👩‍🏫 Teacher notes & answer key (click to expand)

Alignment: Unit 3 (Securing Networks) & Unit 4 (Securing Devices), CED.

01 Port Mapping — Answer: 4444/tcp. Ports 22/80/443/3389 match expected services; 4444 runs a generic shell = mismatched port-application IoC (a backdoor). Discuss port security & why unexpected high ports get flagged.
02 Log Analysis — Answer: the 5 repeated "Failed password for invalid user admin from 203.0.113.66" lines plus the "Accepted password ... 203.0.113.66" line = brute force → successful breach. The single failed login for a real user earlier is a distractor.
03 Packet Capture — Answer: ARP poisoning (on-path / MITM). Two MACs claim 10.10.20.1. Contrast with DNS poisoning, MAC flooding, Smurf.
04 Firewall ACL — Answer: ALLOW TCP 443 must precede DENY TCP ALL. First-match wins; a leading broad DENY blocks 443 too.
05 CTF — Flag 1 (Base64) = APCEP{n3tw0rk_1ntrud3r}; Flag 2 (Hex) = APCEP{ev1l_tw1n}; Flag 3 (reverse) = APCEP{w3p_1s_br0k3n}.

Extend it: pair with picoCTF, Wireshark sample captures, or the CYBER.ORG Range for live tooling.

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]