AP Cybersecurity — Cheatsheet
Formulas, exam-day tips, and key terms on one page.
Formulas & relationships
Risk priority
Risk priority = likelihood x impact
The exact scale can vary, but AP scenarios usually reward the reasoning: common plus severe gets handled before rare plus minor.
On the exam
- For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.
- For a scenario about **confidentiality, integrity, availability, and attack surfaces**, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.
- For a scenario about **identity proof, authentication factors, and social engineering**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat the request as likely social engineering; never approve or disclose an unsolicited authentication challenge.
- For a scenario about **defense in depth for facilities and equipment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Add anti-tailgating and monitoring layers, then assign responsibility for reviewing alerts and logs.
- For a scenario about **asset inventories, media handling, and continuity**, identify the decisive evidence before naming a response. A defensible conclusion here is: Deletion alone is insufficient; sanitize the media and document chain of custody before release.
- For a scenario about **protocol purpose, exposure, and encryption in transit**, identify the decisive evidence before naming a response. A defensible conclusion here is: Require HTTPS end to end and remove the unencrypted service rather than relying on users to notice the risk.
- For a scenario about **baselines, logs, indicators, and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: The combined indicators justify containment and investigation; a single blocked request alone would be weaker evidence.
- For a scenario about **vulnerability reduction through secure configuration**, identify the decisive evidence before naming a response. A defensible conclusion here is: Reduce privilege and patch exposure; either control alone leaves a major part of the risk untreated.
- For a scenario about **malware behavior and evidence-based recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.
- For a scenario about **input handling, authorization, and safe failure**, identify the decisive evidence before naming a response. A defensible conclusion here is: This is an authorization flaw; hiding or randomizing the URL is not a substitute for server-side access checks.
- For a scenario about **data protection across storage, transit, use, and recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Separate and restrict key management; encryption without protected keys does not meaningfully reduce disclosure risk.