AP Cybersecurity FRQ Practice
Practice Device Security Analysis questions.
Practice AP Cybersecurity FRQ 1
LibraryCatalogServer
A school library runs its book-checkout database on a small on-site server. Analyze the provided file permissions, firewall rules, and authentication log to identify a security issue, cite evidence of an attack, recommend a mitigation, and explain the impact of a configuration change — the same skills tested in the real Device Security Analysis question.
Recommended time
35 minutes
Difficulty
Medium-hard
Self-check coverage
0 / 7
What to write
- Part A: read the file permission string in Source 1 and explain the specific risk it creates (who can do what to catalog_db.sqlite).
- Part B: recommend a specific, named fix for the permissions and a specific, named fix for the firewall rules, with reasoning for each.
- Part C: use the timestamps and repeated failed attempts in Source 3 to identify and support the attack type.
- Part D: reason about Rule 3 (port 23 / Telnet) being changed to DENY, covering both legitimate SSH/HTTPS users and the attacker.
Starter shape
SOURCE 1: File Permissions (from "ls -l" on the server)
-rwxrwxrwx labuser staff 4096 Oct 2 09:14 catalog_db.sqlite
SOURCE 2: Firewall Rules (catalog-srv, 10.0.4.12)
RULE ACTION PROTOCOL PORT SOURCE DESTINATION
1 ALLOW TCP 443 ANY 10.0.4.12
2 ALLOW TCP 22 10.0.4.0/24 10.0.4.12
3 ALLOW TCP 23 ANY 10.0.4.12
4 DENY ANY ANY ANY ANY
SOURCE 3: Authentication Log (catalog-srv)
Oct 2 02:14:03 catalog-srv sshd: Failed password for labuser from 198.51.100.77
Oct 2 02:14:05 catalog-srv sshd: Failed password for labuser from 198.51.100.77
Oct 2 02:14:07 catalog-srv sshd: Failed password for labuser from 198.51.100.77
Oct 2 02:14:09 catalog-srv sshd: Failed password for labuser from 198.51.100.77
... (21 more failed attempts from 198.51.100.77 omitted) ...
Oct 2 02:19:41 catalog-srv sshd: Accepted password for labuser from 198.51.100.77
======================================================================
Write your response below, citing specific evidence from the sources.
Part A - Analyze Risk: Identify the security issue in Source 1 and
explain why it puts the catalog database at risk.
Part B - Mitigate Risk: Recommend a specific permission change (name
the exact command or setting) and a specific firewall change to
reduce risk, and explain why each one helps.
Part C - Detect Attacks: Using Source 3, describe what kind of attack
is shown and cite the specific evidence that supports your answer.
Part D - Explain the Impact: If Rule 3 in Source 2 were changed to
DENY, explain the impact on legitimate users and on the attack shown
in Source 3.
Common traps
- Describing the permission string without stating the actual risk (who can read/write the file and why that matters).
- Recommending "make it more secure" without naming a specific permission mode or firewall action.
- Confusing the brute-force attack (many failed logins, one success) with a different attack type like a DDoS or SQL injection, which the sources do not show.
- Not citing the specific IP address or timestamps from the log as evidence.
- Forgetting that Rule 2 already allows SSH on the internal network — closing Telnet does not remove legitimate remote access.
Your response
Cleared when this page reloads. 240 words.
Rule-based feedback
This checks for common structural signals. It is not official scoring.
Looking for something else?