Welcome to Week 2 of our AP Cybersecurity self-study journey!
Follow these steps to guide your learning and track your progress:
1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.
2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.
3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.
4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.
| UNIT 1 | TOPIC 1.2 | Suspicious Website Logins |
1.2.A Identify common signs of a password attack.
| REQUIRED KNOWLEDGE |
| [ ] Recognize bursts of failed logins, unusual source addresses or locations, unexpected login times, many accounts targeted from one source, and sequences of common or stolen credentials. |
| EVIDENCE OF MASTERY / PRACTICE |
| [ ] Review an authentication log and flag likely brute-force, spraying, or stuffing activity. |
| UNIT 1 – Introduction to Security | SKILL FOCUS Detect Attacks |
| STATUS ____________________ | CONFIDENCE ____________________ |
| TARGET DATE ______________ | LAST REVIEWED ______________ |
| SOURCE Fall 2026 CED, Topic 1.2 | SELF RATING 1 2 3 4 5 |
1.2.B Explain how adversaries take advantage of weak authentication.
| REQUIRED KNOWLEDGE |
| [ ] Understand guessing and automated password attacks, reuse of breached credentials, default and common passwords, weak password policies, and single-factor authentication weaknesses. |
| EVIDENCE OF MASTERY / PRACTICE |
| [ ] Match each authentication weakness to a plausible attack path. |
| UNIT 1 – Introduction to Security | SKILL FOCUS Analyze Risk |
| STATUS ____________________ | CONFIDENCE ____________________ |
| TARGET DATE ______________ | LAST REVIEWED ______________ |
| SOURCE Fall 2026 CED, Topic 1.2 | SELF RATING 1 2 3 4 5 |
1.2.C Explain how to make authentication stronger.
| REQUIRED KNOWLEDGE |
| [ ] Use longer unique passwords or passphrases, password managers, MFA, account lockout or throttling, secure recovery, and elimination of default credentials; explain the security benefit of each. |
| EVIDENCE OF MASTERY / PRACTICE |
| [ ] Design a stronger login policy and justify every setting. |
| UNIT 1 – Introduction to Security | SKILL FOCUS Mitigate Risk |
| STATUS ____________________ | CONFIDENCE ____________________ |
| TARGET DATE ______________ | LAST REVIEWED ______________ |
| SOURCE Fall 2026 CED, Topic 1.2 | SELF RATING 1 2 3 4 5 |
SELFSTUDY NOTES
Online password attacks and log analysis are frequently tested topics on the AP Cybersecurity Exam. The following realistic scenario will help you understand these concepts thoroughly.
i. What Is an Online Password Attack?
An adversary attempts to compromise an account by trying common passwords, common password patterns, or stolen passwords in real time.
Three major Indicators of Compromise (IoCs) in authentication logs are:
- Many failed login attempts within a short period: A common sign of a brute-force password attack.
- Login attempts at unusual times: For example, a login attempt at 3:00 a.m. may indicate an automated tool or a remote adversary.
- Login attempts from an unknown device: The attempt originates from a device the user does not normally use.
ii. Practical Authentication-Log Analysis
An exam question may provide a login-activity log and ask you to identify suspicious activity.
- Unexpected geographic location: The user normally logs in from the United States, but an Austrian IP address suddenly appears.
- Unknown device: The log identifies an “Unknown Windows PC.”
- Concentrated failures: Eleven consecutive failed login attempts occur within 15 minutes.
- Most important indicator: A successful login occurs immediately after numerous failed attempts. This may indicate that the adversary has discovered a valid password.
iii. Common Weak Passwords and Defensive Strategies
Common weak-password patterns include:
- A word followed by a year and a symbol: For example, Strawberry2027!
- A pet’s name, birthdate, or simple character substitution: For example, P@ssc0de
Strong Defense: Multifactor Authentication
Enable multifactor authentication (MFA). Authentication factors fall into three categories:
- Something you know: A password or PIN
- Something you have: A phone or security key
- Something you are: A fingerprint or facial recognition
Study Tips
Remember these four elements when analyzing authentication logs:
- An unexpected location or unknown device
- A login attempt at an unusual time
- Many failed attempts within a short period
- A successful login immediately after repeated failures
Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf
Leave a Reply