The exam at a glance
| Section | Weight | Timing | What you do |
|---|---|---|---|
| I · Multiple choice | 70% | 1 hr 20 min · 60 questions | Individual questions and sets of 2–4 questions. Apply security concepts to real situations: identify vulnerabilities, recommend controls, and detect attacks. |
| II · Free response | 30% | 50 min · 1 question | An analysis prompt built on multiple sources such as security policies, firewall configurations, system logs and access permissions. Cite evidence and explain your reasoning. |
Everything happens in Bluebook
You answer every question, including the written analysis, in College Board's Bluebook app. Practice typing timed answers before May.
Think like an adversary, act ethically
The course teaches how attackers work so you can defend systems. Always practice only on systems you are authorized to use.
The multiple-choice section
60 questions in 80 minutes gives you 1 minute 20 seconds per question. Many questions describe a scenario and ask for the best control or the most likely attack. Every unit is tested through the same skills: analyze risk, mitigate it, and detect attacks. Wrong answers lose no points.
Strategies that work
- Identify the asset being protected first, then the threat and the vulnerability.
- Use the CIA triad: is confidentiality, integrity or availability at risk?
- Pick the most direct control: the one that addresses the specific vulnerability described.
- Read logs line by line: timestamps, IP addresses, users and repeated failures are clues.
- Think defense in depth: layered controls beat a single control.
- Never leave a blank. There is no penalty for guessing.
The 5 units, in plain English
Introduction to Security
People, passwords and adversaries.
Be ready to: Explain the CIA triad; strengthen authentication (strong passwords, multifactor); recognize social engineering such as phishing; describe types of cyber adversaries.
Securing Spaces
Locks, cameras and access.
Be ready to: Identify physical vulnerabilities and threats; recommend controls such as badges, locks and cameras; detect physical breaches with adversarial thinking.
Securing Networks
Firewalls, segmentation and traffic.
Be ready to: Explain network segmentation; configure and evaluate firewall rules; analyze network logs for indicators of compromise.
Securing Devices
Computers, phones and IoT.
Be ready to: Harden devices with updates, least privilege and anti-malware; analyze device logs for signs of compromise.
Securing Applications & Data
Access control and encryption.
Be ready to: Apply access controls and permissions; use encryption and hashing to protect data; detect attacks on applications and data such as injection.
Unit weights aren't published yet. College Board organizes the course around four skills applied across every unit: analyze risk, mitigate risk, detect attacks, and collaborate (including with AI). Because the course is new, released questions are still limited.
The analysis question
50 minutes for one in-depth question worth 30% of your score. You analyze several technical sources and explain a security situation with evidence.
Read every source
You may see a security policy, firewall rules, system logs or a permissions table. Each one holds evidence.
Annotate: mark anything that breaks the policy or looks unusual.
Identify the risk
Explain what could go wrong, which asset is at risk, and which part of the CIA triad is affected.
Name the specific line or setting that creates the vulnerability.
Recommend controls
Recommend specific controls and explain how each reduces the risk you identified.
"Enable MFA for admin accounts" beats "improve security".
Detect and explain
Use log evidence to explain whether an attack occurred, what kind, and how you know.
Quote timestamps, IPs or usernames as evidence.
Time plan: About 10 minutes to read the sources, 5 to plan, 30 to write and 5 to check. Every claim needs evidence from a source: a log line, a rule number or a permission setting.
Habits that earn points
- Read every source before writing.
- Quote log lines, rules or settings as evidence.
- Use the CIA triad to describe impact.
- Recommend specific, named controls.
- Explain how each control reduces the risk.
10 traps that cost points
Vague controls
"Improve security" earns nothing. Name the control and how it works.
Encryption vs hashing
Encryption is reversible with a key; hashing is one-way and used for passwords and integrity checks.
Authentication vs authorization
Authentication proves who you are; authorization decides what you may access.
Ignoring the policy
Compare logs and configurations against the stated policy to find violations.
Firewall rule order
Firewalls usually apply the first matching rule, so a broad "allow" above a "deny" can override it.
Single point of defense
Defense in depth layers controls so one failure doesn't expose everything.
Least privilege forgotten
Users should have only the access they need. Excess permissions are a common vulnerability.
Missing the human factor
Many attacks begin with social engineering. Training is a control too.
No evidence
In the free-response question, every claim needs evidence from a source.
Unauthorized practice
Never test attacks on systems you don't own or have permission to use.
A study roadmap to May
A steady plan beats a last-minute rush. Shift the months to match your teacher's pacing.
- Sep – Oct
Unit 1: foundations
CIA triad, authentication, social engineering and adversaries. Build a vocabulary list.
- Nov – Dec
Unit 2: physical security
Physical security assessments and controls. Practice asset-threat-vulnerability analysis.
- Jan – Feb
Unit 3: networks
Segmentation, firewall rules and network log analysis. Start free-response practice.
- Mar – Apr
Units 4–5: devices + data
Device hardening, access control and encryption. Take timed multiple-choice sets.
- Early May
Full timed sections
Full 60-question sets and the 50-minute analysis question under timing.
- May 2027
Exam day
Wednesday, May 5, 2027 (morning session). Sleep well and confirm your start time with your AP coordinator.
3 practice questions
Original questions written by ACT SAT GO in the style of the exam. The free PDF has 10, with full explanations.
- Unit 1 · CIA triad
A ransomware attack encrypts a hospital's patient records so staff can't open them. Which part of the CIA triad is most directly affected?
- A Availability
- B Confidentiality
- C Integrity
- D Authentication
Show answer
Answer: A · Availability. Encrypting the data so staff can't access it attacks availability. (Data may also be stolen, but the main effect is lost access.)
- Unit 3 · Firewalls
A firewall applies the first rule that matches. Rule 1: ALLOW any source, any port. Rule 2: DENY any source, port 23 (Telnet). Rule 3: ALLOW any source, port 443 (HTTPS). What is the problem?
- A HTTPS is blocked
- B Telnet is allowed only from trusted IPs
- C There is no problem
- D Rule 1 allows all traffic, so rule 2 never blocks Telnet
Show answer
Answer: D. With first-match processing, rule 1 allows everything, so the Telnet deny rule is never reached.
- Unit 5 · Hashing
Why do secure systems store password hashes instead of passwords?
- A If the database is stolen, attackers don't directly see the passwords
- B Hashes are easier to read
- C Hashes can be reversed with a key
- D Hashes make logins faster
Show answer
Answer: A. Hashing is one-way, so a stolen database doesn't directly reveal passwords (especially with salting).
How students score
Ranges reflect recent College Board score distributions and shift a little each year. Credit and placement policies vary by college.
Aiming for a 5 in AP Cybersecurity?
Book a free diagnostic session. We'll find your weakest units, review your practice responses and give you a week-by-week plan to exam day.