Virginia Zhu

Blog

  • Week 4 Unit 1 TOPIC 1.4 AI-Based Cybersecurity Attacks

    Welcome to Week 4 of our AP Cybersecurity self-study journey!

    Follow these steps to guide your learning and track your progress:

    1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.

    2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.

    3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.

    4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.

    UNIT 1TOPIC 1.4  |  AI-Based Cybersecurity Attacks

    1.4.A Explain how adversaries use AI-powered tools to augment cyberattacks.

    REQUIRED KNOWLEDGE
    [  ] Explain how AI can scale reconnaissance, personalization, phishing, deepfakes, malware development, vulnerability discovery, translation, and evasion while lowering the skill and time required.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Compare a conventional attack with an AI-augmented version.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.4SELF RATING  1    2    3    4    5
    UNIT 1TOPIC 1.4  |  AI-Based Cybersecurity Attacks

    1.4.B Explain how to protect against some AI-augmented cyberattacks.

    REQUIRED KNOWLEDGE
    [  ] Use independent verification, trusted communication channels, code or verbal verification, awareness training, technical filtering, MFA, least privilege, and human review of AI-generated content.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Recommend layered defenses for an AI-generated impersonation attempt.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Mitigate Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.4SELF RATING  1    2    3    4    5

    SELFSTUDY NOTES

    Artificial intelligence is reshaping cybersecurity. AI based cyberattacks and defense strategies are important topics for the AP Cybersecurity exam. Here is a breakdown of the key ideas.

    i. How do attackers use AI?

    Six AI enabled attack methods to know:

    • Voice and video cloning (deepfakes): Attackers use samples of a target’s voice or video to create a convincing imitation. They may use it to commit fraud or bypass voice authentication.
    • AI generated phishing: Traditional phishing messages often contain awkward language that raises suspicion. AI can produce fluent, natural sounding messages, removing that warning sign.
    • AI driven reconnaissance: Attackers automatically scan websites and social media to collect information about a target and create tailored spear phishing messages.
    • AI assisted malware development: Attackers use AI coding tools to write new malware, modify code, or find vulnerabilities in large codebases more quickly.
    • Prompt injection: Attackers craft prompts that cause a large language model (LLM) to reveal sensitive information.
    • Training data poisoning: Attackers deliberately publish false information online so an LLM absorbs it during training and repeats incorrect claims.

    ii. Real world scenario: Fraud using an AI cloned voice

    Scenario: A relative receives an urgent call that sounds like you. The caller says you have been arrested and needs money for bail. But you have been home all day and never made the call.

    What happened: The attacker obtained a sample of your voice from a video you posted on social media, cloned your voice with AI, and used it to demand money.

    iii. How can you defend against AI enhanced attacks?

    • Agree on a family code word: Set a private code word with family and friends. If someone urgently asks for money, verify their identity using the code word.
    • Enable multifactor authentication (MFA): Even if an attacker clones a voice, another authentication factor can help block unauthorized access.
    • Do not enter sensitive information into AI tools: Information you submit could be exposed or used in ways you did not intend.
    • Verify AI output: Check important claims against authoritative, independent sources, especially when the information could have been manipulated.

    Exam Tips: For AI related questions, focus on how AI changes the scale or effectiveness of a familiar cyberattack and which defenses address it.

    Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf

  • Week 3 Unit 1 TOPIC 1.3 Best Practices for Public Networks

    Welcome to Week 3 of our AP Cybersecurity self-study journey!

    Follow these steps to guide your learning and track your progress:

    1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.

    2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.

    3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.

    4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.

    UNIT 1TOPIC 1.3  |  Best Practices for Public Networks

    1.3.A Identify the type of adversary conducting a cyberattack.

    REQUIRED KNOWLEDGE
    [  ] Distinguish adversaries by skill, resources, motive, access, and relationship to the target, including low-skilled actors, organized criminals, nation-states, hacktivists, and insiders.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Classify the adversary in short attack scenarios and cite evidence.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.3SELF RATING  1    2    3    4    5

    1.3.B Identify types of wireless cyberattacks.

    REQUIRED KNOWLEDGE
    [  ] Recognize eavesdropping, rogue or evil-twin access points, man-in-the-middle activity, deauthentication, and attacks against weak or open wireless encryption.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Identify the likely wireless attack from symptoms and network evidence.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.3SELF RATING  1    2    3    4    5

    1.3.C Describe actions individuals can take to increase protection of sensitive data when using the internet and Wi-Fi.

    REQUIRED KNOWLEDGE
    [  ] Prefer trusted encrypted networks and HTTPS; verify network names; use a reputable VPN when appropriate; disable automatic connection and sharing; update devices; use MFA; and avoid sensitive activity on untrusted networks.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Create a safe-public-Wi-Fi decision checklist.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Mitigate Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.3SELF RATING  1    2    3    4    5

    SELFSTUDY NOTES

    Public Wi-Fi in cafés and airports is convenient, but it can conceal serious risks. In AP Cybersecurity, public-network threats and wireless cyberattacks are essential concepts. Here is a breakdown of the key points.

    i. Types of Adversaries and Their Motivations

    Exam questions often classify adversaries by their capabilities:

    • Script kiddies: Low-skilled adversaries who use tools developed by others without understanding how those tools work.
    • High-skilled adversaries: Adversaries capable of creating or modifying malicious tools and discovering undocumented vulnerabilities known as zero days.
    • Common motivations: Greed, desire for recognition, dedication to a cause, revenge, politics, or beliefs.

    ii. Three Common Wireless Cyberattacks

    • Evil twin attack: An adversary creates a wireless access point with a service set identifier (SSID) similar or identical to that of a legitimate network—for example, imitating “Guest Wi-Fi” with “Free Guest Wi-Fi.” A user may unknowingly connect to the evil twin, allowing the adversary to capture the user’s network traffic.
    • Jamming attack: An adversary floods an area with a strong ElectroMagnetic (EM) signal in the same frequency range as the wireless network. This prevents legitimate traffic between the access point and users. It is a form of Denial-Of-Service (DoS) attack.
    • War driving attack: Adversaries detect wireless-network beacons while driving or walking around a target. They can gather information about the network and identify areas where its signal extends beyond the physical building.

    iii. Real-World Scenario: The Café Wi-Fi Trap

    Scenario: A friend at a café connects to a fake network called “Free Guest Wi-Fi,” while the legitimate network is named “Guest Wi-Fi.” After signing in to a music app, the friend’s password is immediately changed and the account becomes inaccessible.

    What happened: The friend connected to an evil twin. The adversary captured unencrypted credentials and used them to change the account password.

    iv. How to Protect Yourself on Public Networks

    • Verify that the Wi-Fi network’s name exactly matches the network you intend to join.
    • Consider the sensitivity of your data before joining an unencrypted Wi-Fi network.
    • Consider using a Virtual Private Network (VPN), which encrypts traffic between your device and the VPN operator’s system.
    • Disable automatic Wi-Fi connections.
    • Confirm that websites use HTTPS, an encrypted protocol.

    Exam Tips: For wireless-security questions, remember the pairing of NO EvilTwin (an imitation SSID used to capture network traffic) and a VPN, which provides an encrypted connection to the VPN operator’s system.

    Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf

  • Week 2 Unit 1 TOPIC 1.2 Suspicious Website Logins

    Welcome to Week 2 of our AP Cybersecurity self-study journey! 

    Follow these steps to guide your learning and track your progress:

    1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.

    2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.

    3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.

    4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.

    UNIT 1TOPIC 1.2  |  Suspicious Website Logins

    1.2.A Identify common signs of a password attack.

    REQUIRED KNOWLEDGE
    [  ] Recognize bursts of failed logins, unusual source addresses or locations, unexpected login times, many accounts targeted from one source, and sequences of common or stolen credentials.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Review an authentication log and flag likely brute-force, spraying, or stuffing activity.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Detect Attacks
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.2SELF RATING  1    2    3    4    5

    1.2.B Explain how adversaries take advantage of weak authentication.

    REQUIRED KNOWLEDGE
    [  ] Understand guessing and automated password attacks, reuse of breached credentials, default and common passwords, weak password policies, and single-factor authentication weaknesses.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Match each authentication weakness to a plausible attack path.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.2SELF RATING  1    2    3    4    5

    1.2.C Explain how to make authentication stronger.

    REQUIRED KNOWLEDGE
    [  ] Use longer unique passwords or passphrases, password managers, MFA, account lockout or throttling, secure recovery, and elimination of default credentials; explain the security benefit of each.
    EVIDENCE OF MASTERY / PRACTICE
    [  ] Design a stronger login policy and justify every setting.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Mitigate Risk
    STATUS  ____________________CONFIDENCE  ____________________
    TARGET DATE  ______________LAST REVIEWED  ______________
    SOURCE  Fall 2026 CED, Topic 1.2SELF RATING  1    2    3    4    5

    SELFSTUDY NOTES

    Online password attacks and log analysis are frequently tested topics on the AP Cybersecurity Exam. The following realistic scenario will help you understand these concepts thoroughly.

    i. What Is an Online Password Attack?

    An adversary attempts to compromise an account by trying common passwords, common password patterns, or stolen passwords in real time.

    Three major Indicators of Compromise (IoCs) in authentication logs are:

    • Many failed login attempts within a short period: A common sign of a brute-force password attack.
    • Login attempts at unusual times: For example, a login attempt at 3:00 a.m. may indicate an automated tool or a remote adversary.
    • Login attempts from an unknown device: The attempt originates from a device the user does not normally use.

    ii. Practical Authentication-Log Analysis

    An exam question may provide a login-activity log and ask you to identify suspicious activity.

    • Unexpected geographic location: The user normally logs in from the United States, but an Austrian IP address suddenly appears.
    • Unknown device: The log identifies an “Unknown Windows PC.”
    • Concentrated failures: Eleven consecutive failed login attempts occur within 15 minutes.
    • Most important indicator: A successful login occurs immediately after numerous failed attempts. This may indicate that the adversary has discovered a valid password.

    iii. Common Weak Passwords and Defensive Strategies

    Common weak-password patterns include:

    • A word followed by a year and a symbol: For example, Strawberry2027!
    • A pet’s name, birthdate, or simple character substitution: For example, P@ssc0de

    Strong Defense: Multifactor Authentication

    Enable multifactor authentication (MFA). Authentication factors fall into three categories:

    • Something you know: A password or PIN
    • Something you have: A phone or security key
    • Something you are: A fingerprint or facial recognition

    Study Tips

    Remember these four elements when analyzing authentication logs:

    • An unexpected location or unknown device
    • A login attempt at an unusual time
    • Many failed attempts within a short period
    • A successful login immediately after repeated failures

    Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf

  • Week 1 Unit 1 TOPIC 1.1 Understanding Social Engineering

    Welcome to Week 1 of our AP Cybersecurity self-study journey!

    Follow these steps to guide your learning and track your progress:

    1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.
    2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.
    3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.
    4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.
    Unit 1 TOPIC 1.1 Understanding Social Engineering

    1.1.A Identify common indicators of social engineering tactics.

    REQUIRED KNOWLEDGE
    [  ]  Recognize manipulation through phishing or other messages, including requests for sensitive information, malicious links or downloads, intimidation, urgency, unusual sender details, and suspicious context.
    EVIDENCE OF MASTERY / PRACTICE
    [  ]  Annotate a suspicious message and identify at least three indicators.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS CONFIDENCE 
    TARGET DATE  ________________LAST REVIEWED  ________________
    SOURCE  Fall 2026 CED, Topic 1.1SELF-RATING  1  2  3  4  5

    1.1.B Explain how social engineering tactics influence victims to perform a desired action.

    REQUIRED KNOWLEDGE
    [  ]  Explain how psychological pressure, especially fear and time pressure, reduces careful evaluation and encourages disclosure, clicking, downloading, payment, or another unsafe action.
    EVIDENCE OF MASTERY / PRACTICE
    [  ]  For each tactic, explain the human response the attacker is trying to trigger.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS CONFIDENCE 
    TARGET DATE  ________________LAST REVIEWED  ________________
    SOURCE  Fall 2026 CED, Topic 1.1SELF-RATING  1  2  3  4  5

    1.1.C Describe possible impacts for victims of social engineering attacks.

    REQUIRED KNOWLEDGE
    [  ] Connect successful social engineering to credential theft, malware infection, financial loss, identity theft, privacy loss, unauthorized access, and wider organizational compromise.
    EVIDENCE OF MASTERY / PRACTICE
    [  ]  Given a phishing scenario, trace immediate and downstream impacts.
    UNIT  1 – Introduction to SecuritySKILL FOCUS  Analyze Risk
    STATUS CONFIDENCE 
    TARGET DATE  ________________LAST REVIEWED  ________________
    SOURCE  Fall 2026 CED, Topic 1.1SELF-RATING  1  2  3  4  5

    SELFSTUDY NOTES

    Top-tier adversaries often do not attack the system directly: they attack human behavior. Social engineering is a frequently tested concept on the AP Cybersecurity Exam. Below is a summary of the essential information to review.

    i. What Is Social Engineering?

    Social engineering occurs when an adversary uses psychological tactics to manipulate a target into:

    • Revealing sensitive information
    • Downloading a malicious file
    • Clicking a malicious link

    Key idea: An adversary may compromise even a highly secure system by persuading a user to disclose a password or other authentication information.

    ii. Six Common Psychological Tactics

    • Intimidation: Using fear or threatening negative consequences to force compliance.
      Example: “Your account will be locked unless you verify it within 12 hours.”
    • Urgency: Creating time pressure so the target acts quickly without carefully evaluating the request.
      Example: “Act now! This offer expires in 30 minutes.”
    • Authority: Impersonating an executive, administrator, or IT employee.
      Example: “I am from IT support. Please provide your password so I can repair a security vulnerability.”
    • Scarcity: Creating a false impression that a resource or opportunity is extremely limited.
      Example: “Only four spots remain—claim your reward now.”
    • Familiarity: Pretending to be someone the target knows or trusts.
      Example: “I’m your uncle. Can you transfer $1500 to me?”
    • Consensus: Using social proof or group behavior to influence the target.
      Example: “Ninety-six percent of employees have already updated their credentials.”

    iii. Three Serious Consequences

    • Credential theft: Disclosure of a password, one-time password (OTP), or authentication code may allow an adversary to take over an account.
    • Exposure of personal information: Information such as a birthdate or pet’s name can be used to answer account-recovery or security questions.
    • Malware installation: Clicking a malicious link may install malware, such as a Trojan horse or ransomware.

    iv. Exam Practice: How to Identify a Phishing Email

    An exam question may present an email and ask you to identify its red flags:

    • Spoofed or look-alike sender address: For example, g00gle.com, where the letter o has been replaced with the number 0.
    • Urgency and intimidation: The subject line says “Urgent!” and the message warns, “You will be unable to complete your assignment unless you click this link.”
    • Impersonated authority or organization: The sender claims to be “The Google Drive Team.”
    • Vague or nonspecific information: The message does not identify the student or provide the document’s specific name.

    Study Tips:

    When analyzing a phishing scenario:

    • Look for several social engineering tactics being used together.
    • Inspect the sender’s address character by character.
    • Consider the action the adversary is attempting to make the target perform.
    • Identify the possible consequences if the target complies.

    Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf

  • A Step At a Time: AP Cybersecurity 30-Week Self-Study Journey

    In 2025, I won the CyberPatriot Open Division National Championship alongside my teammates on CyberAegis Phoenix. I was also the only girl on the team, so now I want to share what I have learned and help other students build their own cybersecurity skills.

    As an FY27 SWENext Influencer and president of All Girls STEM Society at my high school, I also want to encourage more girls to explore cybersecurity and see it as a field they could explore. Whether you are preparing for an exam or just learning about cybersecurity, everyone is welcome!

    Beginning October 3rd, 2026, I will be publishing free, personal resources to use to prepare for the AP Cybersecurity exam. 

    Why do this?

    Since AP Cybersecurity is a new AP course that just began this year, my school does not yet offer a class for it. I am preparing for the AP exam in May by self-studying, and I know that many students will be doing the same. I am creating this blog to organize the resources I find and create some structure for this new course. Using my competition knowledge and the official College Board Course and Exam Description to cover topics, I will be working through all the required material and also providing practice to master the topics. Through all of this, I will also be learning along the way!

    This blog is a student-led initiative, stemming from my passion for cybersecurity. I plan to improve the resources as I work through the topics and receive feedback from readers. 30 weekly lessons will run from October 3, 2026, through May 3, 2027. The weekly schedule is not mandatory, so earlier posts will always be up for self-pacing.

    Learn Along With Me

    No cybersecurity competition experience is required to learn from this blog, simply just an interest in the field and a sprinkle of courage for the exam in May. I especially hope this project reaches students who also do not have a cybersecurity course at school and girls who are curious about this field. I want to make it easier to study for this exam and provide some motivation to keep going!

    To receive new weekly posts make sure to subscribe, and join me on October 3 for Week 1. Always leave a comment if there is any cybersecurity topic you hope to understand better!

Leave a Reply