Tian2
The Tian2 Study Library AP Edition · Tian2 Editorial Bureau
Volume I · MMXXVI AP Cybersecurity
Library› Catalogue› AP Cybersecurity
⁂   AP Career Kickstart · First Exam May 2027

Cybersecurity Study Library.

Complete unit-by-unit study guides for all five units of AP Cybersecurity — covering the human, physical, network, device, and application attack surfaces. Built from the official CED (effective Fall 2026) with original Tian2 content.

5 units 60 MCQ + 1 FRQ 130 minutes Fully digital (Bluebook)
Total Time 130 minutes (2 hr 10 min)
Section I 60 MCQ · 80 min · 70%
Section II 1 FRQ · 50 min · 30%
Platform BB Bluebook — fully digital
Exam Structure

How the exam is scored.

Section I — Multiple Choice (70%)

60 questions in 80 minutes. Questions appear as individual items and as stimulus sets of 2–4 questions sharing a scenario, log excerpt, network diagram, or firewall ruleset. Stimulus materials include firewall ACL tables, system and application logs, network topology diagrams, packet captures, and file permission listings.

No calculator permitted (no mathematics required beyond basic logic). No reference sheet — students must know all terminology from memory. All responses entered digitally in Bluebook.

Section II — Free Response (30%)

One multi-document device/security analysis scenario lasting 50 minutes. Students receive multiple information sources from a single device or environment — firewall rules, system logs, application logs, file permissions, and device policy — and must:

  1. Explain components of a security policy or firewall rule
  2. Identify attack indicators (IoCs/IoAs) in log data
  3. Configure permissions and rules to close vulnerabilities
  4. Recommend hardening measures with justification from evidence

The rubric rewards: correct identification + citation of evidence from the provided source + explanation of why the defense reduces risk. Partial credit is available.

The Three Core Skills

All five units assess the same three skill categories, each weighted 25–40% of the exam:

SkillWeight
Analyze Risk — identify vulnerabilities, evaluate threats, assess likelihood and severity25–40%
Mitigate Risk — configure layered security controls; assess their effectiveness25–40%
Detect Attacks — monitor systems; identify IoCs and IoAs; recognize attack patterns in logs25–40%

A fourth skill, Collaborate (work with teams, communicate to technical and non-technical audiences, use AI tools for documentation), is integrated throughout but not separately weighted on the exam.

Career Kickstart Credential

Students who earn a qualifying score receive:

  • An employer-endorsed AP Cybersecurity Credential aligned to the NIST Cybersecurity Framework
  • A free voucher for CompTIA Security+ exam prep (CertMaster/TestOut) and the exam itself (~$350 value)
  • The credential can be stacked with the AP Networking Credential

Entry-level career pathways: Information Security Analyst, Network Administrator, SOC Analyst.

Curriculum · 5 Units

Study by unit.

1.
Introduction to Security
Social engineering variants (phishing, spear-phishing, whaling, vishing, smishing, pretexting) · OSINT as a reconnaissance tool · Password attacks (brute force, credential stuffing, dictionary, password spraying) · Wireless threats (evil twin APs, rogue hotspots, Wi-Fi jamming) · AI-driven attacks (voice cloning, deepfakes) · AI-based defenses (anomaly detection, behavioral analytics)
Weeks 1–7
Human attack surface
Study guide ›
2.
Securing Spaces
CIA Triad (Confidentiality, Integrity, Availability) · Risk assessment: Likelihood × Impact matrix · Defense in depth · Physical access controls (badge, biometrics, mantrap) · Insider threats · Cyberattack kill chain (8 phases) · Security control types (preventative, detective, corrective, compensating) · Environmental threats (HVAC, power, fire)
Weeks 8–13
Most exam questions
Study guide ›
3.
Securing Networks
TCP/IP model · Network attacks (ARP poisoning, MAC flooding, DNS spoofing, DDoS, MitM) · Firewalls and ACL rules (first-match-wins) · Network segmentation (VLANs, DMZ) · IDS/IPS (NIDS, NIPS, HIDS) · SIEM (log aggregation, correlation) · Network hardening · Packet capture analysis
Weeks 14–20
Most technically challenging
Study guide ›
4.
Securing Devices
Malware taxonomy (virus, worm, trojan, ransomware, rootkit, botnet) · MFA factors (know/have/are) · Principle of least privilege and RBAC · Patch management · IoT vulnerabilities · MDM · Cryptographic hashing (MD5, SHA-256, salting vs. rainbow tables) · Digital forensics (chain of custody)
Weeks 21–27
Endpoint security
Study guide ›
5.
Securing Applications and Data
Symmetric (AES) vs. asymmetric (RSA) encryption · Digital signatures and non-repudiation · PKI and X.509 certificates · HTTPS and TLS handshake · Application vulnerabilities (SQL injection, XSS, buffer overflow) · Secure coding practices (parameterized queries, input validation) · Data protection (at rest vs. in transit, DLP)
Weeks 28–34
Cryptography and AppSec
Study guide ›
Exam Intelligence

Ten hardest topics and common traps.

  1. Firewall ACL rule reading. The exam tests first-match-wins logic — the correct answer is the first rule that matches the packet, not the "most relevant" rule. Students who read all rules and pick the best match lose points.
  2. Tailgating vs. piggybacking. Tailgating = following an authorized person through a door without their knowledge or consent. Piggybacking = doing so with their (sometimes unwitting) consent. Exam scenarios are designed to make these hard to distinguish.
  3. Virus vs. worm mechanics. A virus requires a host file to spread; it cannot propagate on its own. A worm is self-propagating — it does not need a host. Students frequently swap these definitions.
  4. Salting defeats rainbow tables. Students often know both terms but cannot explain why salting works: a unique random salt appended to each password before hashing makes precomputed hash tables useless because no two identical passwords produce the same hash.
  5. Symmetric vs. asymmetric use cases. Asymmetric encryption (RSA) is used for key exchange and digital signatures. Symmetric (AES) is used for bulk data encryption once the key is securely shared. TLS uses a hybrid: RSA to exchange an AES session key, then AES to encrypt the data stream.
  6. FRQ justification requirement. Naming the correct attack type is not enough — the rubric requires you to (a) cite specific evidence from the provided logs or rules and (b) explain the mechanism by which the recommended control reduces risk.
  7. Social engineering variant taxonomy. Phishing (generic email), spear-phishing (targeted by name/role), whaling (targeting executives), vishing (voice call), smishing (SMS), pretexting (fabricated scenario/authority), intimidation (threat-based). Exam scenarios include context clues for each.
  8. IoC vs. IoA. Indicator of Compromise (IoC) = post-breach forensic evidence (malware hash, suspicious IP, strange outbound connection). Indicator of Attack (IoA) = behavioral pattern suggesting an attack is in progress (unusual login times, mass file access, lateral movement commands).
  9. Risk assessment matrix. Risk priority = Likelihood × Impact. A high-likelihood/low-impact risk and a low-likelihood/high-impact risk may yield the same matrix score but require different controls. The exam asks you to recommend proportionate controls for the calculated priority.
  10. Log analysis under time pressure. The FRQ presents realistic log files with timestamps, event types, source IPs, and error codes. Practice parsing timestamps first, then look for anomalies (unusual hours, repeated failures, unexpected process names, outbound connections to unfamiliar IPs).
Industry Alignment

Frameworks this course aligns to.

NIST Cybersecurity Framework

The course mirrors NIST CSF's five functions: Identify (asset inventory, risk assessment), Protect (access controls, hardening), Detect (IDS/SIEM, log monitoring), Respond (incident handling), and Recover (business continuity). Unit 2's CIA Triad and risk framework map directly to the Identify function.

NICE Workforce Framework

The National Initiative for Cybersecurity Education (NICE) maps course topics to workforce roles: Protect and Defend (Units 2–4), Analyze (Units 1, 3, 5 — log and threat analysis), and Investigate (Unit 4 — digital forensics and chain of custody).

CompTIA Security+

AP Cybersecurity content overlaps significantly with CompTIA Security+ domain areas: Threats/Attacks/Vulnerabilities (Units 1, 3, 4), Architecture and Design (Units 2, 3), Implementation (Units 3, 5), and Identity and Access Management (Unit 4). The credential voucher makes Security+ a natural next step.

Official Resources

From College Board.

Note: No released past exam questions exist as of June 2026. The first official national exam is May 2027; FRQs are expected to be released approximately July 2027.

Our worked solutions and practice questions are original instructional content created by Tian2 AP. They are aligned to the concepts and skills described in College Board’s Course and Exam Description and are not reproductions of, or affiliated with, College Board’s official materials.