AP Cybersecurity Topics Index | All 5 Units & Every Concept

AP Cybersecurity • Concept Index

AP Cybersecurity Topics (All 5 Units)

Every AP Cybersecurity concept organized by the College Board's five units. Each card links to a deep-dive guide with the concept explained, examples, exam tips, and practice. Includes a core-concept quick reference, one exam insight per unit, the mistakes that cost the most points, and an FAQ. Built by Tanner Crow, AP CS teacher at Blue Valley North High School, 11+ years. Aligned to the College Board CED.

Course Hub Unit 1: Intro to Security Unit 2: Securing Spaces Unit 3: Securing Networks Unit 4: Securing Devices Unit 5: Apps & Data Quick Reference Exam Tips FAQ Practice
Unit 1 • 5 CED topics

Unit 1: Introduction to Security

Focus: how adversaries target people and weak access. Social engineering is the single highest-frequency Unit 1 concept.

Unit 1 introduces the human and access side of security: how attackers manipulate people, exploit weak authentication, take advantage of public networks, and increasingly use AI to scale attacks. Expect message-analysis questions that ask you to name the tactic and channel, plus questions on strengthening authentication.

Full Unit 1 study guide →
Social EngineeringManipulating people into revealing information, clicking links, or downloading files. The entry point for most real attacks.Topic 1.1 Intimidation vs UrgencyThe two framework tactics. Intimidation threatens a consequence; urgency imposes a deadline. Know how to spot the primary one.Topic 1.1 Phishing, Vishing & SmishingSocial engineering by email, voice call, and text. Same goal, different channel. Identify the channel in a scenario.Topic 1.1 Password AttacksBrute force, credential stuffing, and password spraying. How attackers exploit weak or reused passwords.Topic 1.2 Strengthening AuthenticationWhy weak authentication fails and how length, uniqueness, and password managers make accounts harder to crack.Topic 1.2 Multi-Factor AuthenticationCombining factors you know, have, and are. Why MFA helps and why a phished one-time code can still defeat it.Topic 1.2 Public Wi-Fi DangersWhy open networks are risky: interception of unencrypted traffic and exposure of sensitive data.Topic 1.3 Evil Twin & Rogue Access PointsA fake network that mimics a real SSID to capture traffic. Plus jamming and war driving.Topic 1.3 VPNs & Protecting Your DataHow a VPN encrypts traffic, plus the individual protections for using the internet on untrusted networks.Topic 1.3 AI-Powered CyberattacksHow adversaries use AI to scale and sharpen attacks, from more convincing phishing to faster reconnaissance.Topic 1.4 Deepfakes & Voice CloningAI-generated audio and video used to impersonate trusted people and defeat human verification.Topic 1.4 AI in Cyber DefenseHow defenders use AI for faster, more accurate threat detection and response.Topic 1.5
Unit 2 • 4 CED topics

Unit 2: Securing Spaces

Focus: the security foundations of the whole course (adversaries, attack phases, risk, controls, defense in depth) plus physical security.

Unit 2 lays the groundwork for everything that follows: who the adversaries are, the phases of an attack, how risk is assessed, the types of security controls, and defense in depth. It then applies these to physical spaces, where attackers bypass digital controls through physical access.

Full Unit 2 study guide →
7 Social Engineering TacticsPretexting, authority, intimidation, consensus, scarcity, familiarity, and urgency.Topic 2.1 Types of Threat ActorsScript kiddies, hacktivists, insider threats, cyberterrorists, and criminal organizations.Topic 2.1 Phases of a CyberattackRecon, initial access, persistence, lateral movement, taking action, evading detection.Topic 2.1 Risk Assessment & StrategiesLikelihood and severity, plus avoidance, transference, mitigation, and residual risk.Topic 2.1 Types of Security ControlsThe CIA triad, and controls classified by type and by function.Topic 2.1 Defense in DepthLayering multiple controls so that one failure does not breach the whole system.Topic 2.1 Physical Security AttacksTailgating, shoulder surfing, dumpster diving, and card cloning.Topic 2.2 Protecting Physical SpacesManagerial and physical controls: locks, card readers, vestibules, UPS, and policy.Topic 2.3 Detecting Physical AttacksCameras, security guards, and motion sensors, plus effective placement.Topic 2.4
Unit 3 • 5 CED topics

Unit 3: Securing Networks

Focus: know the protect controls (segmentation, firewalls) and the detect controls (IDS vs IPS) cold. The IDS/IPS distinction is a classic trap.

Unit 3 covers how networks are attacked and defended: common network attacks, managerial and wireless controls, segmentation to limit blast radius, firewalls to filter traffic, and the monitoring tools that detect intrusions. Many questions hinge on matching the right control to the right threat.

Full Unit 3 study guide →
Network Attacks OverviewARP spoofing, MAC flooding, DNS poisoning, and smurf attacks, plus how adversaries reach a network.Topic 3.1 MAC FloodingOverwhelming a switch so it broadcasts traffic to every port, enabling sniffing.Topic 3.1 DNS PoisoningCorrupting name resolution so a correct domain name leads to a malicious server.Topic 3.1 DoS & DDoS AttacksFlooding a system to make it unavailable. The difference between a single source and a distributed botnet.Topic 3.1 Man-in-the-Middle AttacksIntercepting communication between two parties to read or alter it. Why encryption defeats it.Topic 3.1 Managerial & Wireless ControlsPolicies and wireless protections that reduce network risk before an attack starts.Topic 3.2 Network Segmentation & VLANsDividing a network so a breach in one segment cannot reach the rest.Topic 3.3 FirewallsFiltering traffic by rules to allow or block based on source, destination, and port.Topic 3.4 IDS vs IPSAn IDS detects and alerts; an IPS detects and blocks. The exam tests this distinction directly.Topic 3.5 SIEM & Network MonitoringCentralizing logs to spot patterns and detect attacks across many systems at once.Topic 3.5
Unit 4 • 4 CED topics

Unit 4: Securing Devices

Focus: classify malware by how it spreads and what it does, and know the authentication factors (know, have, are, where).

Unit 4 focuses on the devices themselves: the malware that attacks them, how authentication and password hashing protect access, how devices are hardened with anti-malware and patching, and how attacks on devices are detected. Malware classification and the authentication factors are high-yield here.

Full Unit 4 study guide →
Types of MalwareVirus, worm, trojan, ransomware, spyware, keylogger, logic bomb, rootkit, and fileless.Topic 4.1 Authentication & HashingThe four authentication factors and why passwords are stored as hashes.Topic 4.2 Protecting DevicesAnti-malware, patching the OS and software, and host-based firewalls.Topic 4.3 Detecting Device AttacksIndicators of compromise and the controls that surface them.Topic 4.4
Unit 5 • 6 CED topics

Unit 5: Securing Applications and Data

Focus: cryptography is the heavy hitter. Get symmetric vs asymmetric exactly right, and know that input sanitization stops both injection and XSS.

Unit 5 is the largest unit and covers application and data security: the application attacks (SQL injection, XSS), the access controls that limit exposure, the cryptography that protects data, input sanitization, and detecting attacks on data. The cryptography topics carry the most weight and the most confusion.

Full Unit 5 study guide →
SQL InjectionInserting malicious commands through input to read or alter a database.Topic 5.1 Cross-Site Scripting (XSS)Injecting code a browser runs, reflected (Type I) vs stored (Type II).Topic 5.1 Access Controls & Least PrivilegeAuthorization and giving each entity only the access it needs.Topic 5.2 Symmetric vs Asymmetric EncryptionOne shared key vs a public/private key pair, and why key length matters.Topics 5.3-5.4 Input SanitizationCleaning untrusted input to stop injection and XSS, plus secure by design.Topic 5.5 Detecting Data AttacksVerifying a file's hash to detect tampering, plus monitoring.Topic 5.6

Core Concept Quick Reference

The highest-yield concepts across all five units, with the one exam note that matters most for each.
Concept What it is Key exam note
Social engineering Manipulating a person, not a machine. Identify the primary tactic (intimidation or urgency) and the channel.
Intimidation vs urgency Threat vs deadline. Both can appear; pick the one the message leans on hardest.
Phishing / vishing / smishing Social engineering by email / voice / text. Same goal, different channel. Naming the exact channel is the skill.
MFA Two or more authentication factors. Strong, but a phished one-time code can still defeat it.
Evil twin Fake Wi-Fi mimicking a real network. Verify the network name; a VPN protects traffic if you connect.
CIA triad Confidentiality, Integrity, Availability. Map every control to the goal it protects.
Defense in depth Layered controls. One control failing should not breach the whole system.
Tailgating Following someone through a secure door. Physical social engineering; mantraps and badges defend it.
DoS vs DDoS Flooding from one vs many sources. DDoS uses a distributed botnet; both target availability.
Man-in-the-middle Intercepting traffic between two parties. Encryption (TLS) defeats reading the intercepted data.
Firewall Rule-based traffic filter. Allows or blocks by source, destination, and port.
IDS vs IPS Detect-and-alert vs detect-and-block. IDS only warns; IPS actively stops the traffic.
Network segmentation Dividing a network into zones. Limits blast radius so a breach cannot spread freely.
Malware types Virus, worm, trojan, ransomware, spyware. Worm self-spreads; virus needs a host and user action.
Authentication factors Know, have, are. Combining categories is what makes MFA strong.
Symmetric encryption One shared key. Fast, but the key must be shared securely.
Asymmetric encryption Public + private key pair. Public key encrypts; only the private key decrypts.
Hashing One-way fingerprint of data. Not reversible and not encryption; used for integrity.
SQL injection Malicious input into a database query. Input validation and parameterized queries defend it.
Least privilege Minimum access needed. Limits what a compromised account can reach.

Exam Tips: One Insight Per Unit

The single highest-value thing to internalize for each unit.
Unit 1

Name the tactic and the channel

Message questions reward identifying intimidation vs urgency and the delivery channel. Naming the exact sub-type like whaling is enrichment, not required.

Unit 2

Run everything through the CIA triad

For any control or attack, ask which goal it touches: confidentiality, integrity, or availability. That single lens answers a surprising number of questions.

Unit 3

IDS warns, IPS blocks

The most common Unit 3 trap is treating detection and prevention as the same. An IDS only alerts; an IPS actively stops the traffic.

Unit 4

Classify malware by spread and effect

Do not memorize names in isolation. Ask how it spreads (on its own or with user action) and what it does (encrypt, spy, control).

Unit 5

Public key encrypts, private key decrypts

The most-missed crypto point. Asymmetric: anyone can encrypt with the public key, only the private key holder can decrypt. Hashing is one-way and is not encryption.

Common Mistakes That Cost Points

The errors that show up most when reviewing cybersecurity assessments.

Confusing a tactic with an impact

Wrong: "The victim felt intimidated" is an impact of social engineering.
Right: Intimidation is a tactic. The impacts are what the attacker gained: personal information, credentials, or malware.

Thinking MFA stops everything

Wrong: Multi-factor authentication makes an account unphishable.
Right: MFA raises the bar, but a victim can still be tricked into reading a one-time code aloud, handing over a valid factor.

Mixing up symmetric and asymmetric keys

Wrong: The public key decrypts the message.
Right: The public key encrypts; only the matching private key can decrypt. Symmetric uses one shared key for both.

Treating hashing as encryption

Wrong: You can decrypt a hash to recover the original data.
Right: Hashing is one-way. It verifies integrity and cannot be reversed to reveal the input.

IDS vs IPS

Wrong: An intrusion detection system blocks attacks.
Right: An IDS detects and alerts. An IPS detects and blocks. Only the IPS stops the traffic.

Virus vs worm

Wrong: A worm needs a user to open a file to spread.
Right: A worm self-propagates across a network. A virus attaches to a host and needs user action.

DoS vs DDoS

Wrong: A DoS and a DDoS are the same attack.
Right: A DoS comes from a single source; a DDoS is distributed across many compromised machines. Both target availability.

CIA triad confusion

Wrong: Keeping data secret is integrity.
Right: Secrecy is confidentiality. Integrity means the data is accurate and unaltered. Availability means it is accessible when needed.

Frequently Asked Questions

Five: Introduction to Security, Securing Spaces, Securing Networks, Securing Devices, and Securing Applications and Data. Each unit follows the same arc of identifying vulnerabilities, protecting against them, and detecting attacks.
It has two sections: a multiple-choice section and a free-response section built around applied security scenarios. Both pull from all five units. See the exam format guide for details.
The course launches nationally in the 2026 to 2027 school year, with the first exam in 2027. Studying early is a real advantage in a course with little existing competition for material.
The three core goals of security: Confidentiality (only authorized people can read data), Integrity (data is accurate and unaltered), and Availability (data and systems are accessible when needed). Almost every control maps to one of these.
Symmetric uses the same key to encrypt and decrypt, which is fast but requires sharing the key safely. Asymmetric uses a public key to encrypt and a private key to decrypt, which solves the key-sharing problem. Remember: public key encrypts, private key decrypts.
A virus attaches to a file or program and needs a user action to spread. A worm spreads across a network on its own. Both are malware; the spreading mechanism is the key distinction.
Intimidation threatens a negative consequence; urgency imposes a deadline. Many messages use both, so the exam asks for the primary tactic.
You should identify the category of attack and the matching defense. Memorizing rare sub-type labels or specific tool names is usually enrichment, not a required skill.

Ready to practice?

Drill these concepts with exam-style questions, or review the full study guide.

Practice Questions Full Study Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours
✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

✉

Email

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]