How to Get a 5 in AP Cybersecurity

What we have for Cybersecurity

Everything below is free to work through and is organised against the same units as the official course framework, so you can go straight to the unit you are weakest in.

Score data

AP Cybersecurity is a new enough course that we do not have a published national score distribution to show you, and we would rather say so than invent one. Once the College Board releases distributions for this exam, this section will show them.

The 5 units of AP Cybersecurity

Unit names and exam weights follow the published course framework. Weights are the share of the multiple-choice section each unit is worth, so they tell you exactly where to spend time: Unit 5 (Securing Applications and Data), Unit 4 (Securing Devices), Unit 3 (Securing Networks) are worth roughly 12–12% between them.

A unit-by-unit study order

Work the units in framework order for your first pass — later units in Cybersecurity lean on earlier ones — then let your error log, not the unit numbers, drive the review phase. Each row below opens the first lesson of that unit.

1. 1Introduction to SecurityUnit 1 of the exam · 3 lessons · starts with “Threats, Vulnerabilities, and Risk”
2. 2Securing Physical SpacesUnit 2 of the exam · 3 lessons · starts with “Securing Physical Spaces”
3. 3Securing NetworksUnit 3 of the exam · 3 lessons · starts with “Networks, Segmentation, and Firewalls”
4. 4Securing DevicesUnit 4 of the exam · 3 lessons · starts with “Device Hardening and Malware Detection”
5. 5Securing Applications and DataUnit 5 of the exam · 3 lessons · starts with “Applications, Data, and Cryptography”

Formulas and relationships to know

Pulled from the Cybersecurity lessons. The same list is on the printable Cybersecurity cheatsheet.

On exam day

The exam-specific warnings our Cybersecurity lessons flag as you go.

• For AP Cybersecurity prompts, do not stop at naming an attack. Tie the attack to the exploited weakness and then recommend a control that actually reduces that risk.
• For a scenario about **confidentiality, integrity, availability, and attack surfaces**, identify the decisive evidence before naming a response. A defensible conclusion here is: The incident affects integrity and confidentiality; restoring a backup alone would not explain the disclosure or stop the attacker.
• For a scenario about **identity proof, authentication factors, and social engineering**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat the request as likely social engineering; never approve or disclose an unsolicited authentication challenge.
• For a scenario about **defense in depth for facilities and equipment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Add anti-tailgating and monitoring layers, then assign responsibility for reviewing alerts and logs.
• For a scenario about **asset inventories, media handling, and continuity**, identify the decisive evidence before naming a response. A defensible conclusion here is: Deletion alone is insufficient; sanitize the media and document chain of custody before release.
• For a scenario about **protocol purpose, exposure, and encryption in transit**, identify the decisive evidence before naming a response. A defensible conclusion here is: Require HTTPS end to end and remove the unencrypted service rather than relying on users to notice the risk.
• For a scenario about **baselines, logs, indicators, and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: The combined indicators justify containment and investigation; a single blocked request alone would be weaker evidence.
• For a scenario about **vulnerability reduction through secure configuration**, identify the decisive evidence before naming a response. A defensible conclusion here is: Reduce privilege and patch exposure; either control alone leaves a major part of the risk untreated.
• For a scenario about **malware behavior and evidence-based recovery**, identify the decisive evidence before naming a response. A defensible conclusion here is: Contain first, investigate scope, eradicate the cause, then recover from trusted backups and monitor for recurrence.
• For a scenario about **input handling, authorization, and safe failure**, identify the decisive evidence before naming a response. A defensible conclusion here is: This is an authorization flaw; hiding or randomizing the URL is not a substitute for server-side access checks.

Everything for Cybersecurity, in order of use

Frequently asked questions