AP Cybersecurity Study Guide: Complete Review of All 5 Units, Key Terms & Exam Strategies (2026-2027)
AP Cybersecurity Study Guide
Complete review of all 5 units — key concepts, essential vocabulary, exam strategies, and links to detailed unit guides. Aligned to the official College Board course framework.
By Tanner Crow, AP CS Teacher (11+ Years) · Updated March 2026
📑 Table of Contents
How to Use This Study Guide Unit 1: Introduction to Security Unit 2: Securing Spaces Unit 3: Securing Networks Unit 4: Securing Devices Unit 5: Securing Applications and Data Exam Strategy and Study Tips Complete Key Terms Glossary Frequently Asked Questions Related ResourcesHow to Use This Study Guide
This page is your central hub for studying all five units of AP Cybersecurity. It gives you a concise overview of the key concepts, essential vocabulary, and exam tips for each unit — plus links to our full-length, detailed unit guides for deeper study.
The AP Cybersecurity Exam tests three core skills across all five units: Analyze Risk (What is the vulnerability and how likely/severe is an attack?), Mitigate Risk (What security controls should be implemented?), and Detect Attacks (How do we monitor for and identify incidents?). As you study each unit, keep asking yourself these three questions.
🎯 Study Plan Recommendation
First pass: Read through each unit section on this page to build a high-level understanding. Second pass: Dive into each detailed unit study guide for comprehensive content and practice questions. Third pass: Review the glossary at the bottom and test yourself on key terms. Final prep: Take our unit exams and quizzes to assess readiness.
For full details on the exam format, sections, and the AP Cybersecurity Credential, see our AP Cybersecurity Exam Format guide.
Unit 1: Introduction to Security
Social engineering, password attacks, public Wi-Fi threats, AI-powered attacks, and AI cyber defense
Unit 1 introduces the personal security concepts that form the foundation of the entire course. You will learn how adversaries manipulate people through social engineering, how weak authentication is exploited, how public Wi-Fi creates opportunities for attackers, and how AI is changing both offensive and defensive cybersecurity.
Key Concepts
Social Engineering (Topic 1.1): Adversaries use psychological tactics like intimidation and urgency to manipulate targets into revealing sensitive information, clicking malicious links, or downloading malware. Victims may give up personal details (names, birthdates, pet names) that are commonly used as security challenge questions, one-time passwords, or credentials that enable account takeover.
Password Attacks (Topic 1.2): Online password attacks involve adversaries trying to log in to a device or service using common passwords, patterns, or stolen credentials. Signs of a password attack include many failed login attempts in a short period, login attempts at unusual times, and attempts from unknown devices. Defenses include longer, more random passwords, spreading special characters throughout, and enabling multifactor authentication (MFA).
Wireless Threats (Topic 1.3): Adversaries can set up evil twin access points with SSIDs similar to legitimate networks to capture victim traffic. Jamming attacks flood the wireless frequency range to create denial of service. War driving detects wireless signals extending outside physical buildings. Adversary skill levels range from low-skilled (using tools built by others) to high-skilled (creating new tools and discovering zero-day vulnerabilities). Motivations include greed, recognition, causes, revenge, and politics.
AI-Powered Attacks (Topic 1.4): Adversaries use AI to create voice clones and digital avatars for impersonation, generate convincing phishing messages in any language, extract sensitive data from LLMs through prompt manipulation, poison LLM training data, conduct automated reconnaissance, and write or modify malware. Defenses include establishing shared secrets with relatives, enabling MFA, avoiding entering personal data into AI tools, and verifying AI output with non-AI sources.
AI for Defense (Topic 1.5): Defenders use AI to review security configurations and recommend improvements, analyze code for vulnerabilities, suggest detection rules for automated systems, and sort millions of daily digital events to identify malicious activity. A critical principle: AI recommendations should always be reviewed by a knowledgeable human before implementation.
💡 Exam Tip — Unit 1
Unit 1 questions often present you with a suspicious email, text, or login scenario and ask you to identify the social engineering tactic, the type of wireless attack, or the recommended defensive measure. Practice identifying urgency vs. intimidation, distinguishing evil twin from jamming, and knowing when MFA helps vs. when shared secrets help.
Essential Vocabulary:
Unit 2: Securing Spaces
CIA triad, risk assessment, defense-in-depth, adversary types, attack phases, and physical security
Unit 2 shifts from personal security to organizational security. This is the foundational theory unit — you learn the frameworks (CIA triad, defense-in-depth, risk assessment) that underpin everything in Units 3–5. You also study adversary classification, the phases of a cyberattack, and how physical security controls prevent, detect, and correct attacks.
Key Concepts
Cyber Foundations (Topic 2.1): Extends social engineering with additional tactics: pretexting (creating a believable backstory), authority (impersonating someone with power), consensus (social pressure), scarcity (limited availability), and familiarity (pretending to be someone known). Adversary types include script kiddies (low-skilled, motivated by greed/recognition), hacktivists (cause-driven), insider adversaries (legitimate access), cyberterrorists (state/political disruption), and transnational criminal organizations (financial gain through ransomware/IP theft).
Cyberattack Phases: Reconnaissance (OSINT gathering), Initial Access (social engineering or weak credentials), Persistence (C2 protocols, RATs, rootkits), Lateral Movement (privilege escalation), Taking Action (data exfiltration, service disruption), and Evading Detection (log deletion, file cleanup).
Risk Assessment: Risk exists when a threat can exploit a vulnerability to compromise an asset. Assessment considers likelihood (target value, exploit difficulty, adversary skill) and severity (financial, reputational, operational impact). Results can be quantitative (numeric scales, dollar amounts) or qualitative (low/medium/high). Risk management options: Avoid, Transfer, Mitigate, or Accept (residual risk).
CIA Triad and Controls: Confidentiality (only authorized access), Integrity (data accuracy), Availability (accessible when needed). Controls classified by type: Physical (locks, fences, cameras), Technical (firewalls, encryption), Managerial (policies, procedures). Controls classified by function: Preventative (stop attacks), Detective (identify attacks in progress), Corrective (fix problems after).
Physical Security (Topics 2.2–2.4): Physical attacks include piggybacking (social engineering to get someone to hold the door), tailgating (following behind without knowledge), shoulder surfing, dumpster diving, and card cloning. Mitigations include badge readers, access control vestibules, turnstiles, disabling USB ports, UPS backup power, and employee security awareness training. Detection methods: cameras, motion sensors, security guards (stationary vs. patrolling), and badge-entry door timing logs.
💡 Exam Tip — Unit 2
Unit 2 is heavy on exam questions because it introduces the foundational frameworks used in all later units. Expect questions that give you a scenario and ask you to classify risk (likelihood + severity), identify the appropriate control type (preventative/detective/corrective), or explain why defense-in-depth requires multiple layers. The distinction between piggybacking (victim knowingly lets attacker in) vs. tailgating (victim unaware) is a classic exam trap.
Essential Vocabulary:
Unit 3: Securing Networks
Network attacks, firewalls, ACLs, segmentation, VLANs, wireless security, IDS/IPS, SIEM
Unit 3 applies the risk/mitigate/detect framework to computer networks. This is the most technical unit, covering specific network attacks, firewall types and configuration, network segmentation strategies, and automated detection systems. Expect detailed questions about ACL rules, firewall placement, and how to identify indicators of compromise in network logs.
Key Concepts
Network Attacks (Topic 3.1): ARP poisoning modifies the ARP table to redirect traffic through the adversary’s device (an on-path/man-in-the-middle attack using MAC spoofing). MAC flooding overwhelms a switch’s MAC address table, forcing broadcast mode so the adversary can eavesdrop (sniffing). DNS poisoning plants fake DNS records to redirect browsers to credential-harvesting sites. Smurf attacks flood a network with ICMP requests to the broadcast address, creating a DDoS. A rogue access point plugged into an open port bypasses firewalls entirely.
Firewalls (Topic 3.4): Stateless firewalls filter by packet headers only (IPs, ports, protocols). Stateful firewalls additionally track connection states. Next-generation firewalls (NGFW) add intrusion prevention, deep packet inspection, and application-level filtering. Access control lists (ACLs) are ordered rules that permit or deny traffic. Rules are checked in order — the first matching rule executes. Changing rule order changes what traffic is allowed. Each network segment should have a firewall, and every ingress/egress point to the internet must have one.
Segmentation (Topic 3.3): A screened subnet (DMZ) sits between the public internet and the internal network, hosting publicly-facing resources. Subnetting divides networks by IP addressing to contain breaches. VLANs logically separate devices on central switches. Port security limits MAC addresses per switch port to prevent MAC flooding.
Detection (Topic 3.5): NIDS (Network IDS) monitors for malicious activity and generates alerts. NIPS (Network IPS) can additionally take action (blocking IPs, closing ports). SIEM aggregates data from multiple sources to detect patterns. Detection methods: Signature-based (fast, low false positives, cannot detect novel attacks) vs. Anomaly-based (catches new attacks, higher false positives, needs baseline) vs. Hybrid (most expensive but most comprehensive). Organizations set alert thresholds — too high misses attacks, too low causes alert fatigue.
💡 Exam Tip — Unit 3
This unit produces the most technical exam questions. You must be able to read firewall ACL rules and determine which traffic is allowed or denied. Remember: rules are checked in order, and the first match wins. Also know the tradeoffs between signature-based and anomaly-based detection — the exam loves asking when each is preferred (high traffic = signature, consistent patterns = anomaly, sensitive data = hybrid).
Essential Vocabulary:
Unit 4: Securing Devices
Device types, malware taxonomy, hashing, salting, password attacks, MFA, and device hardening
Unit 4 focuses on individual devices — from servers and PCs to IoT and embedded systems. You study the full malware taxonomy, how cryptographic hashing protects stored passwords, the specific mechanics of password attacks, and how organizations harden devices through authentication controls and security policies.
Key Concepts
Device Types (Topic 4.1): Servers provide services to other computers. Personal computers are designed for individual use. Handheld/mobile devices run on battery power. Embedded computers are part of larger machines (cars, medical equipment, industrial controls). IoT devices are everyday items with embedded computers (thermostats, coffee makers). Embedded devices tend to be slower, cheaper, with minimal storage, making them uniquely vulnerable.
Malware Taxonomy: Viruses require user activation (opening a file). Worms spread without human interaction. Trojans are hidden in harmless-looking software; RATs provide remote access. Ransomware encrypts files and demands payment. Spyware tracks user actions. Keyloggers record keystrokes (software or hardware). Logic bombs trigger only when specific conditions are met. Rootkits embed in the OS and can hide themselves from detection. Fileless malware lives in RAM and uses legitimate programs.
Hashing and Authentication (Topic 4.2): Cryptographic hash functions convert input into a fixed-length output. Properties: collision resistant (hard to find two inputs producing the same hash), pre-image resistant (cannot reverse the hash), repeatable (same input = same output), fixed length. Common hashes: MD5, SHA-1, SHA-256, SHA-512, NTHash (MD5 and SHA-1 are deprecated). Passwords should be stored as hashes, not plaintext. Salt (random bits) is added before hashing so identical passwords produce different hashes.
Password Attacks: Online attacks try credentials in a live portal. Offline attacks work against a captured hash database. Types: Brute force (try every combination), Dictionary (try common passwords), Rainbow table (pre-computed hash lookup), Password spraying (try one common password across many accounts), Credential stuffing (try stolen or default credentials). Salting defeats rainbow table attacks because each user’s hash is unique.
💡 Exam Tip — Unit 4
Know the difference between each malware type — the exam often describes a scenario and asks you to identify the malware. The key distinction: viruses need user action, worms don’t. Also understand why salting matters: without salt, two users with the same password have identical hashes, so an adversary who cracks one cracks both. Salting ensures every hash is unique even for identical passwords.
Essential Vocabulary:
Unit 5: Securing Applications and Data
Cryptography (AES, RSA), PKI, digital certificates, application security, and data protection
Unit 5 covers the security of software applications and data — the innermost layer of a defense-in-depth strategy. You study symmetric and asymmetric cryptography in detail, public key infrastructure (PKI), how applications are attacked and defended, and how to detect attacks on data.
Key Concepts
Symmetric Cryptography: Uses a single shared key for both encryption and decryption. AES (Advanced Encryption Standard) is the current standard, with key lengths of 128, 192, or 256 bits. Advantage: fast. Challenge: securely sharing the key between parties. Best for encrypting data at rest and within a secure network.
Asymmetric Cryptography (Topic 5.4): Uses a key pair — a public key (shared freely) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. RSA is the most well-known asymmetric algorithm. Advantage: solves the key distribution problem. Disadvantage: slower than symmetric encryption. Often used to securely exchange symmetric keys.
Public Key Infrastructure (PKI): A framework for managing digital certificates and encryption keys. Certificate Authorities (CAs) issue digital certificates that bind a public key to an entity’s identity. Digital certificates enable secure communication (HTTPS), email signing, and authentication. PKI creates a chain of trust that allows parties who have never met to communicate securely.
Application Security (Topic 5.5): Applications are vulnerable to attacks where user-input is not properly validated, allowing adversaries to inject malicious commands (such as database manipulation). Secure coding practices include input validation, input sanitization, and the principle of least privilege for application permissions. AI tools can review code for vulnerabilities, but recommendations must always be vetted by human developers.
Detecting Attacks on Data (Topic 5.6): Monitoring for unauthorized data access, unexpected data modifications, and anomalous application behavior. Hashing can verify data integrity — if the hash of a file changes unexpectedly, the file has been modified. Log analysis and SIEM tools play a critical role in detecting data breaches.
💡 Exam Tip — Unit 5
The critical distinction: symmetric = one key, fast, key distribution problem. Asymmetric = two keys, solves distribution, slower. Know that asymmetric encryption is often used to exchange the symmetric key, after which the faster symmetric encryption handles the actual data. Also understand that hashing is NOT encryption — hashing is one-way (cannot be reversed), while encryption is two-way (can be decrypted with the right key).
Essential Vocabulary:
Exam Strategy and Study Tips
Think Like an Analyst
The AP Cybersecurity Exam places you in the role of a cybersecurity analyst making evidence-based decisions. For every topic you study, train yourself to answer four questions: (1) What is the vulnerability? (2) How would an adversary exploit it? (3) What controls would mitigate it? (4) How would you detect an attack? This maps directly to the three core exam skills.
Master the Scenario Format
Both MCQ and FRQ sections present realistic scenarios with artifacts like log files, network diagrams, and firewall rules. Practice reading these artifacts before reading the question. Identify what the artifact shows, what looks normal, and what looks suspicious. Then read the question and answer based on your analysis. This is the predict-first approach that prevents you from being swayed by convincing but incorrect options.
Don’t Memorize — Understand Relationships
The exam rarely asks you to define a term in isolation. Instead, it asks you to apply concepts to new situations. Understand the relationships: how does a specific vulnerability connect to a specific attack? Why does a particular control address that vulnerability? When would you choose one detection method over another? Relational understanding beats rote memorization every time.
Build a Study Schedule
With five units of content, cramming is not effective. Allocate roughly equal study time to Units 2, 3, and 4 (the heaviest), with slightly less for Units 1 and 5. Review key vocabulary weekly. Take our unit quizzes and exams after finishing each unit to identify gaps before moving on.
🎯 Top 5 Things to Know Cold on Exam Day
1. The CIA triad and how every control maps to confidentiality, integrity, or availability
2. The six cyberattack phases and what happens at each stage
3. How to read firewall ACL rules and determine allowed/denied traffic
4. The malware taxonomy — the distinction between each type
5. Symmetric vs. asymmetric encryption — when to use each and why they’re combined
Complete Key Terms Glossary
All essential vocabulary across all five units. Use this as a quick-reference checklist — if you can define every term and explain its significance in context, you are well prepared for the exam.
Unit 1 — Introduction to Security
Unit 2 — Securing Spaces
Unit 3 — Securing Networks
Unit 4 — Securing Devices
Unit 5 — Securing Applications and Data
Frequently Asked Questions
The exam covers five units: Introduction to Security (social engineering, passwords, Wi-Fi, AI threats), Securing Spaces (CIA triad, risk assessment, defense-in-depth, physical security), Securing Networks (network attacks, firewalls, ACLs, VLANs, IDS/IPS/SIEM), Securing Devices (malware, hashing, authentication, device hardening), and Securing Applications and Data (cryptography, PKI, application security). See the exam format page for full details on sections and skills.
Study unit by unit following the official course framework. For each topic, master the vulnerability, the attack method, the mitigation, and the detection technique. Practice with scenario-based questions. Use this study guide for an overview, then dive into each detailed unit guide for deeper study and practice questions. Focus on applying concepts to new situations rather than memorizing definitions.
The most tested terms include CIA triad, defense-in-depth, social engineering, phishing, MFA, evil twin, ARP poisoning, DNS poisoning, DDoS, firewall ACL, VLAN, IDS/IPS, SIEM, malware types (virus, worm, trojan, ransomware, rootkit), cryptographic hash, salt, brute force, rainbow table, symmetric/asymmetric encryption, AES, RSA, and PKI. See the complete glossary above for the full list organized by unit.
APCSExamPrep.com offers 250+ practice questions across all five units, plus unit quizzes and a 20-question unit exam for Unit 1. Our complete AP Cybersecurity course includes structured exercises and assessments aligned to the official framework. The College Board has also released sample questions in the official course framework PDF.
Most students find Unit 3 (Securing Networks) the most challenging because it is the most technical — it requires understanding specific network attacks (ARP poisoning, MAC flooding, DNS poisoning), reading firewall ACL rules, and comparing detection methods. Unit 4 (Securing Devices) is also demanding due to the volume of malware types and the detailed mechanics of cryptographic hashing. Start your study early with these two units and allocate extra review time for them.
No. AP Cybersecurity has no coding prerequisites and the exam does not require you to write code. You do need to understand how adversaries use code-based tools (like malware and automated password crackers) and how defenders use AI tools to review code for vulnerabilities, but you will not be asked to write or debug code yourself. The exam is entirely concept-based and scenario-driven.
Why Students Trust APCSExamPrep.com
Built by a real AP teacher with verified, measurable results
11+ years teaching AP Computer Science at Blue Valley North High School · 5.0 Wyzant rating
Related AP Cybersecurity Resources
📚 Full AP Cybersecurity Course
Lessons, exercises, quizzes, and unit exams — the complete course built unit by unit.
📄 AP Cybersecurity Exam Format
Sections, skills, Bluebook platform, credential details, and comparison tables.
🔒 Unit 1 Study Guide
Social engineering, password attacks, Wi-Fi threats, and AI-powered cybersecurity.
🏢 Unit 2 Study Guide
CIA triad, risk assessment, defense-in-depth, and physical security controls.
🌐 Unit 3 Study Guide
Network attacks, firewalls, ACLs, VLANs, IDS/IPS, and SIEM detection.
💻 Unit 4 Study Guide
Malware, hashing, authentication, password attacks, and device hardening.
🔐 Unit 5 Study Guide
Symmetric/asymmetric cryptography, PKI, application security, and data protection.
👩🎓 1-on-1 Tutoring
Personalized tutoring with 11+ years AP CS experience and 451+ five-star reviews.
Ready to Start Studying?
Jump into Unit 1 or explore the full course with lessons, exercises, quizzes, and 250+ practice questions — all free.
AP® is a registered trademark of the College Board, which was not involved in the production of this resource.
Source: AP Cybersecurity Course Framework V.1 (College Board)
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
tanner@apcsexamprep.com
Courses
AP CSA, CSP, & Cybersecurity
Response Time
Within 24 hours
Prefer email? Reach me directly at tanner@apcsexamprep.com