AP Cybersecurity Unit 1

Introduction to Security

This unit builds the AP Cyber vocabulary students use everywhere else: assets, vulnerabilities, threats, controls, authentication, adversaries, risk, and responsible use of AI.

Lessons and exercises

Worked examples, exercises with solutions, and downloadable unit problems.

Unit 1: Introduction to Security

1.1 Security Thinking and Risk Language
Security is not just blocking bad things. It is deciding what matters, what could go wrong, how likely it is, how much it would hurt, and which control changes the outcome.
2 exercises →
1.2 Social Engineering and Human Workflow
Attackers often target trust, urgency, fear, helpfulness, or routine habits. Phishing, pretexting, baiting, and impersonation work because people are part of every system.
2 exercises →
1.3 Authentication and Account Protection
Authentication proves identity. Authorization decides what that identity may do. Strong security separates those ideas and reduces the value of stolen credentials.
2 exercises →
1.4 Adversaries, Motives, and AI-Enabled Risk
Adversaries can be outsiders, insiders, careless users, automated bots, or people misusing legitimate access. AI can amplify both attacks and defensive analysis.
2 exercises →

Problems PDF Solutions PDF Unit MCQ

Defender Lens

A strong answer in Unit 1 sounds like a careful security analyst: identify what could go wrong, explain why it matters, and choose a control that changes the risk.

Detailed Study Notes

What to understand before practice

Read these notes slowly, then connect each idea to the topic panels below.

Security questions start with the protected asset

Every security decision begins by naming what must be protected. In AP Cybersecurity, the asset might be an account, a phone, a classroom laptop, a database, a building entry system, or the availability of a school service. If the answer does not protect the asset named in the prompt, it is probably solving the wrong problem.

After naming the asset, separate the condition from the possible event. A shared password, open Wi-Fi network, or outdated device is a vulnerability. Account takeover, data exposure, denial of service, or unauthorized change is the threat or impact that may result.

Mitigation is not a magic word for any security tool. A mitigation must change the likelihood or impact of the specific risk. MFA reduces the value of a stolen password; training helps reduce social engineering success; logging improves detection and investigation.

Exam Connection

When choices sound similar, prefer the answer that ties asset, weakness, and control together instead of the answer that only names a security product.

Social engineering targets workflow, trust, and pressure

Social engineering works because people follow routines and trust familiar names, logos, roles, and urgent requests. A convincing message may pressure a student to click quickly, ask a staff member to bypass a normal process, or trick a family member into sharing a one-time code.

The safest response is usually procedural: verify through a separate trusted channel, report the message, avoid using links in the suspicious message, and preserve evidence. “Tell users to be careful” is weaker than designing a workflow that makes verification normal.

Personal information can become a security weakness. Birthdays, school names, pet names, and activity details may help attackers guess passwords, answer recovery questions, or craft more believable messages.

Exam Connection

Look for the requested action in the scenario. If the attacker wants a code, password, reset link, or download, the best answer usually blocks that action and verifies separately.

Authentication proves identity; authorization limits actions

Authentication answers “Who are you?” Authorization answers “What are you allowed to do?” A secure system needs both. A user can log in correctly and still have too much access if permissions are poorly managed.

Multi-factor authentication is powerful because it requires more than one kind of proof. If a password is stolen, the attacker still needs another factor. MFA is especially important for email, administrator accounts, financial systems, and any account that can reset other accounts.

Account lifecycle matters. Old accounts, shared administrator accounts, and permissions that remain after a role changes all create risk. Security is not only about login; it is also about reviewing and removing access.

Exam Connection

Do not choose an answer that only makes passwords more complex if the scenario clearly involves stolen credentials, excessive permissions, or account recovery abuse.

AI changes both attack speed and defensive review

AI tools can help attackers draft more convincing messages, translate scams, imitate voices, summarize public information about a target, or generate variants of malicious code. That does not make every attack advanced, but it can make attacks faster and harder to spot.

Defenders can also use AI to review configuration ideas, summarize logs, suggest detection rules, and help triage large volumes of events. The important habit is verification: AI output should be checked by a knowledgeable person before it becomes a real security decision.

Sensitive information should not be pasted into unapproved AI tools. A prompt can reveal internal system details, personal data, or incident information that should remain protected.

Exam Connection

Strong AI-security answers balance usefulness with review, privacy, and verification. Avoid choices that treat AI as either always trustworthy or always useless.

Security Thinking and Risk Language

Security is not just blocking bad things. It is deciding what matters, what could go wrong, how likely it is, how much it would hurt, and which control changes the outcome.

Apply It

For any scenario, write a four-part sentence: The asset is __, the vulnerability is __, the threat is __, so the mitigation should __.

Avoid This Trap

Do not label everything as a threat. Weak password policy is a vulnerability; account takeover is a threat; multi-factor authentication is a mitigation.

Social Engineering and Human Workflow

Attackers often target trust, urgency, fear, helpfulness, or routine habits. Phishing, pretexting, baiting, and impersonation work because people are part of every system.

Apply It

The best defense usually combines verification, reporting, training, and authentication controls rather than telling users to simply be careful.

Avoid This Trap

If an answer asks a user to share a password, one-time code, or reset link, it is almost always unsafe.

Authentication and Account Protection

Authentication proves identity. Authorization decides what that identity may do. Strong security separates those ideas and reduces the value of stolen credentials.

Apply It

Use multi-factor authentication for important accounts, remove old access, avoid shared administrator accounts, and review unusual login signals.

Avoid This Trap

A longer password helps, but it does not replace MFA, account lifecycle management, or least privilege.

Adversaries, Motives, and AI-Enabled Risk

Adversaries can be outsiders, insiders, careless users, automated bots, or people misusing legitimate access. AI can amplify both attacks and defensive analysis.

Apply It

Treat AI output as a draft, not an authority. Verify recommendations and do not paste sensitive configurations into untrusted tools.

Avoid This Trap

Do not assume every suspicious action requires a sophisticated attacker. Ordinary misconfiguration and leftover access are common causes.

Evidence Drill

Practice the AP Cyber evidence habit

A club officer reports a password reset email they did not request. List three evidence sources you would check before deciding whether the account was compromised.

Review Questions

1What is the difference between authentication and authorization?
2Why is verification through a trusted channel stronger than replying to a suspicious message?
3How can a control reduce likelihood but not completely remove risk?

FRQ practice & solutions

Need help with this topic?

Work through questions with a tutor and get help with the steps you find difficult.

Get help with this topic