How to Get a 5 in AP Cybersecurity

What we have for Cybersecurity

Everything below is free to work through and is organized against the same units as the official course framework, so you can go straight to the unit you are weakest in.

Score data

AP Cybersecurity is a new enough course that we do not have a published national score distribution to show you, and we would rather say so than invent one. Once the College Board releases distributions for this exam, this section will show them.

What a 5 in Cybersecurity takes

The specific habits that separate a 5 from a 3 on this exam, drawn from the scoring patterns for Cybersecurity.

• When a question asks for "the first action", it is almost always containment — stop ongoing harm before investigating or cleaning.
• Name the principle, then apply it to the scenario. Naming least privilege earns nothing on its own; explaining what the attacker could not have reached earns the point.
• Be precise that hashing is not encryption. Saying passwords should be "encrypted" is the single most common way to lose a cryptography point.
• For any control you propose, be ready to say what threat it addresses and what it does not. A control with no stated threat model reads as a guess.

The 5 units of AP Cybersecurity

Unit names follow the published course framework. Cybersecurity is one of the courses whose framework does not weight units against the exam, so there is no “heaviest unit” to chase — spread your time by where your own errors are.

A unit-by-unit study order

Work the units in framework order for your first pass — later units in Cybersecurity lean on earlier ones — then let your error log, not the unit numbers, drive the review phase. Each row below opens the first lesson of that unit.

1. 1Introduction to SecurityNo published exam weighting · 3 lessons · starts with “Threats, Vulnerabilities, and Risk”
2. 2Securing Physical SpacesNo published exam weighting · 3 lessons · starts with “Securing Physical Spaces”
3. 3Securing NetworksNo published exam weighting · 3 lessons · starts with “Networks, Segmentation, and Firewalls”
4. 4Securing DevicesNo published exam weighting · 3 lessons · starts with “Device Hardening and Malware Detection”
5. 5Securing Applications and DataNo published exam weighting · 3 lessons · starts with “Applications, Data, and Cryptography”

Formulas and relationships to know

Pulled from the Cybersecurity lessons. The same list is on the printable Cybersecurity cheatsheet.

On exam day

The exam-specific warnings our Cybersecurity lessons flag as you go.

• For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.
• For a scenario about **confidentiality, integrity, availability, and attack surfaces**, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.
• For a scenario about **identity proof, authentication factors, and social engineering**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat the request as likely social engineering; never approve or disclose an unsolicited authentication challenge.
• For a scenario about **defense in depth for facilities and equipment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Add anti-tailgating and monitoring layers, then assign responsibility for reviewing alerts and logs.
• For a scenario about **asset inventories, media handling, and continuity**, identify the decisive evidence before naming a response. A defensible conclusion here is: Deletion alone is insufficient; sanitize the media and document chain of custody before release.
• For a scenario about **protocol purpose, exposure, and encryption in transit**, identify the decisive evidence before naming a response. A defensible conclusion here is: Require HTTPS end to end and remove the unencrypted service rather than relying on users to notice the risk.
• For a scenario about **baselines, logs, indicators, and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: The combined indicators justify containment and investigation; a single blocked request alone would be weaker evidence.
• For a scenario about **vulnerability reduction through secure configuration**, identify the decisive evidence before naming a response. A defensible conclusion here is: Reduce privilege and patch exposure; either control alone leaves a major part of the risk untreated.
• For a scenario about **malware behavior and evidence-based recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.
• For a scenario about **input handling, authorization, and safe failure**, identify the decisive evidence before naming a response. A defensible conclusion here is: This is an authorization flaw; hiding or randomizing the URL is not a substitute for server-side access checks.

Everything for Cybersecurity, in order of use

Interactive labs for Cybersecurity

Frequently asked questions