🔐

AP Cybersecurity — Cheatsheet

Formulas, exam-day tips, and key terms on one page.

Formulas & relationships

Risk priority

Risk priority = likelihood x impact

The exact scale can vary, but AP scenarios usually reward the reasoning: common plus severe gets handled before rare plus minor.

On the exam

For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.
For a scenario about **confidentiality, integrity, availability, and attack surfaces**, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.
For a scenario about **identity proof, authentication factors, and social engineering**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat the request as likely social engineering; never approve or disclose an unsolicited authentication challenge.
For a scenario about **defense in depth for facilities and equipment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Add anti-tailgating and monitoring layers, then assign responsibility for reviewing alerts and logs.
For a scenario about **asset inventories, media handling, and continuity**, identify the decisive evidence before naming a response. A defensible conclusion here is: Deletion alone is insufficient; sanitize the media and document chain of custody before release.
For a scenario about **protocol purpose, exposure, and encryption in transit**, identify the decisive evidence before naming a response. A defensible conclusion here is: Require HTTPS end to end and remove the unencrypted service rather than relying on users to notice the risk.
For a scenario about **baselines, logs, indicators, and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: The combined indicators justify containment and investigation; a single blocked request alone would be weaker evidence.
For a scenario about **vulnerability reduction through secure configuration**, identify the decisive evidence before naming a response. A defensible conclusion here is: Reduce privilege and patch exposure; either control alone leaves a major part of the risk untreated.
For a scenario about **malware behavior and evidence-based recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.
For a scenario about **input handling, authorization, and safe failure**, identify the decisive evidence before naming a response. A defensible conclusion here is: This is an authorization flaw; hiding or randomizing the URL is not a substitute for server-side access checks.
For a scenario about **data protection across storage, transit, use, and recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Separate and restrict key management; encryption without protected keys does not meaningfully reduce disclosure risk.

How to get a 5

When a question asks for "the first action", it is almost always containment — stop ongoing harm before investigating or cleaning.
Name the principle, then apply it to the scenario. Naming least privilege earns nothing on its own; explaining what the attacker could not have reached earns the point.
Be precise that hashing is not encryption. Saying passwords should be "encrypted" is the single most common way to lose a cryptography point.
For any control you propose, be ready to say what threat it addresses and what it does not. A control with no stated threat model reads as a guess.

Key terms

CIA triad — Confidentiality, Integrity and Availability — the three properties security exists to protect. Almost every control maps to one of them, and naming which one is what a question is usually asking.

Threat vs. vulnerability vs. risk — A threat is an actor or event that could cause harm. A vulnerability is a weakness it could exploit. Risk combines the likelihood of that happening with the impact if it does.

Least privilege — Every account and process gets only the access its role actually requires — and no more. Limits the blast radius when any single account is compromised.

Defense in depth — Layering independent controls so that one failure does not become a breach. The reason a firewall AND endpoint protection AND access control all exist.

Preventive vs. detective vs. corrective control — Preventive stops an event (MFA, segmentation). Detective notices it (logging, alerting, IDS). Corrective restores after it (backups, incident response).

Hashing vs. encryption — Encryption is reversible with a key and is for data you must read back. Hashing is one-way and is for verification — passwords, integrity checks. Never store passwords encrypted.

Salt — A unique random value stored with each password hash. Makes identical passwords hash differently and defeats precomputed rainbow tables, forcing per-account attack.

Why bcrypt/scrypt/Argon2 rather than SHA-256 for passwords — They are deliberately slow and tunable. Fast hashes let an attacker test billions of guesses per second against a stolen hash file.

Symmetric vs. asymmetric encryption — Symmetric uses one shared key — fast, but the key must be distributed securely. Asymmetric uses a public/private pair — solves distribution, much slower. TLS uses both.

Key management — Encryption is only as strong as the protection of its keys. A key stored beside the ciphertext provides almost no security against anyone who reaches the data.

Multifactor authentication (MFA) — Requires factors from different categories: something you know, something you have, something you are. Defeats a stolen password on its own.

Phishing — Social engineering that induces a target to reveal credentials or run attacker code, usually by impersonating a trusted sender. Targets the human, not the software.

Credential stuffing — Automated replay of username/password pairs leaked from another breach. Works because people reuse passwords — which is why one recoverable password store harms many services.

SQL injection — Untrusted input interpreted as database commands, letting an attacker read, alter or destroy data. Parameterized queries prevent it; filtering for quotes does not.

Cross-site scripting (XSS) — Untrusted input rendered into a page executes as script in a victim's browser under the site's origin — enabling session theft or actions as the victim. Fixed by contextual output encoding.

Why blocklists fail — They enumerate badness. The defender must anticipate every attack; the attacker needs one that was not anticipated. Prefer allowlists and structural fixes.

Network segmentation — Dividing a network so systems can only reach what they need, with default-deny between zones. Limits lateral movement after an initial foothold.

Zero trust — Never trust based on network location. Verify identity, device posture, and context for every request, whether it originates inside or outside the perimeter.

Incident response order — Prepare → Identify → Contain → Eradicate → Recover → Lessons learned. Contain before eradicating: stop ongoing harm while scope is still unknown.

Volatile evidence — Data that exists only while a system is running: RAM contents, running processes, open connections, in-memory keys. A reboot destroys it permanently.

Separation of duties — A sensitive action requires two independent people. Addresses the insider and compromised-account threat, which access control cannot — the actor is authorized.

3-2-1 backup rule — Three copies, on two media types, one offsite. Add: at least one offline or immutable, because ransomware encrypts reachable connected backups.

Why untested backups are not a control — Backups fail silently — stopped jobs, unreadable media, missing keys. A restore you have never performed is an assumption. Test restoration on a schedule.

Ransomware and the triad — Primarily attacks availability: the data is intact but denied to authorized users. Modern operators also exfiltrate first, so confidentiality is usually breached too.