AP Cybersecurity Unit 3

Securing Networks

This unit covers how devices communicate, how defenders reduce unnecessary access, and how logs, firewall rules, segmentation, wireless controls, and monitoring reveal network risk.

Lessons and exercises

Worked examples, exercises with solutions, and downloadable unit problems.

Unit 3: Securing Networks

3.1 Network Segmentation and Exposure
Segmentation separates systems so a guest device, student device, web server, database, and administrator workstation do not all have the same reach.
2 exercises →
3.2 Firewall and Rule Reasoning
Firewall rules describe source, destination, protocol, port, and action. The safest rule set permits required traffic and blocks unnecessary paths.
2 exercises →
3.3 Wireless, Rogue Devices, and Network Access
Wireless access adds risk because radio signals extend beyond walls. Authentication, encryption, approved access points, and monitoring matter.
2 exercises →
3.4 Network Evidence and Indicators
Logs can show blocked connections, unusual destinations, repeated failures, unexpected ports, or connections outside normal hours.
2 exercises →

Problems PDF Solutions PDF Unit MCQ

Defender Lens

A network answer should read like traffic control: which source, which destination, which service, which rule, and which evidence suggests normal or suspicious activity.

Detailed Study Notes

What to understand before practice

Read these notes slowly, then connect each idea to the topic panels below.

Networks are about permitted communication

A network security question usually asks who should be allowed to communicate with what. Think in terms of source, destination, service, direction, and business need. A student laptop, guest phone, web server, and grade database should not all have equal access.

Segmentation limits the blast radius of a compromise. If a guest device is infected, it should not be able to reach administrative systems. If a web server is public, it should still have limited access to internal databases.

Least privilege applies to traffic too. Allow only the connections required for the workflow and block unnecessary paths.

Exam Connection

For firewall or segmentation questions, translate the scenario into “A may talk to B using C, but not D.” That plain sentence usually reveals the answer.

Firewall rules require careful reading

A firewall rule is not just “allow” or “deny.” The meaning depends on source, destination, protocol, port, order, and whether the rule is an exception. A rule that allows one service should not be expanded to all services.

A common exam trap is choosing a broad rule because it makes the application work. A safer rule is narrow enough to support the need without opening unrelated access.

Rule order can matter in real systems. If the course scenario shows a table, read from top to bottom if the prompt says the first matching rule applies.

Exam Connection

Reject answers that use “allow all” logic unless the prompt clearly describes a low-risk public resource with no sensitive connection.

Wireless risk extends beyond the walls

Wireless networks broadcast through physical space, so attackers may interact from a hallway, parking lot, neighboring room, or public area. This makes authentication, encryption, approved access points, and separation especially important.

Guest Wi-Fi should be separated from internal services. A visitor may need internet access, but that does not mean they need access to printers, databases, school file shares, or administrative systems.

Rogue access points and look-alike networks exploit trust. Users may connect to a network name that appears familiar unless devices and policies guide them toward approved networks.

Exam Connection

A hidden SSID alone is weak. Look for answers involving strong authentication, encryption, approved access points, and network separation.

Network logs are evidence, not instant conclusions

Network logs can show blocked traffic, repeated connection attempts, unusual destinations, unexpected ports, DNS lookups, or activity outside normal hours. These signals help analysts decide what to investigate.

One unusual event may have a harmless explanation. Stronger evidence usually comes from patterns or correlation: firewall logs plus authentication logs, DNS logs plus endpoint alerts, or repeated attempts from the same source.

Detection and response are linked. A log entry should lead to a next step such as checking device ownership, reviewing authentication, isolating a host, or updating a rule.

Exam Connection

If the question asks what the evidence shows, avoid overclaiming. If it asks what to do next, choose the next investigation or containment step that fits the evidence.

Network Segmentation and Exposure

Segmentation separates systems so a guest device, student device, web server, database, and administrator workstation do not all have the same reach.

Apply It

Ask what traffic is necessary. Then deny or isolate traffic that is not needed for the workflow.

Avoid This Trap

A flat network is convenient, but it increases blast radius when one device is compromised.

Firewall and Rule Reasoning

Firewall rules describe source, destination, protocol, port, and action. The safest rule set permits required traffic and blocks unnecessary paths.

Apply It

Translate rules into plain English before answering: who can talk to whom, over what service, and what is blocked.

Avoid This Trap

Do not allow all traffic just because one application must be reachable.

Wireless, Rogue Devices, and Network Access

Wireless access adds risk because radio signals extend beyond walls. Authentication, encryption, approved access points, and monitoring matter.

Apply It

Choose encrypted, authenticated Wi-Fi for internal resources and keep guest networks separated from sensitive systems.

Avoid This Trap

A hidden network name is not a strong security control by itself.

Network Evidence and Indicators

Logs can show blocked connections, unusual destinations, repeated failures, unexpected ports, or connections outside normal hours.

Apply It

Treat a log as evidence to investigate, not automatic proof. Correlate firewall, DNS, authentication, and application data.

Avoid This Trap

A single unusual event may be benign; repeated or correlated signals are stronger.

Evidence Drill

Practice the AP Cyber evidence habit

Students can reach a public web app but should not reach the database directly. Write the plain-English allow/deny logic for the firewall rules.

Review Questions

1What does segmentation reduce when a single device is compromised?
2Why is an allow-only-what-is-needed mindset safer than allow-by-default?
3Which logs would you compare after seeing repeated blocked connections?

FRQ practice & solutions

Need help with this topic?

Work through questions with a tutor and get help with the steps you find difficult.

Get help with this topic