Category: Uncategorized

Welcome to Week 3 of our AP Cybersecurity self-study journey!

Follow these steps to guide your learning and track your progress:

1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.

2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.

3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.

4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.

UNIT 1

TOPIC 1.3  |  Best Practices for Public Networks

1.3.A Identify the type of adversary conducting a cyberattack.

REQUIRED KNOWLEDGE

[  ] Distinguish adversaries by skill, resources, motive, access, and relationship to the target, including low-skilled actors, organized criminals, nation-states, hacktivists, and insiders.

EVIDENCE OF MASTERY / PRACTICE

[  ] Classify the adversary in short attack scenarios and cite evidence.

UNIT  1 – Introduction to Security	SKILL FOCUS  Analyze Risk
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.3	SELF RATING  1    2    3    4    5

1.3.B Identify types of wireless cyberattacks.

REQUIRED KNOWLEDGE

[  ] Recognize eavesdropping, rogue or evil-twin access points, man-in-the-middle activity, deauthentication, and attacks against weak or open wireless encryption.

EVIDENCE OF MASTERY / PRACTICE

[  ] Identify the likely wireless attack from symptoms and network evidence.

UNIT  1 – Introduction to Security	SKILL FOCUS  Analyze Risk
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.3	SELF RATING  1    2    3    4    5

1.3.C Describe actions individuals can take to increase protection of sensitive data when using the internet and Wi-Fi.

REQUIRED KNOWLEDGE

[  ] Prefer trusted encrypted networks and HTTPS; verify network names; use a reputable VPN when appropriate; disable automatic connection and sharing; update devices; use MFA; and avoid sensitive activity on untrusted networks.

EVIDENCE OF MASTERY / PRACTICE

[  ] Create a safe-public-Wi-Fi decision checklist.

UNIT  1 – Introduction to Security	SKILL FOCUS  Mitigate Risk
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.3	SELF RATING  1    2    3    4    5

SELFSTUDY NOTES

Public Wi-Fi in cafés and airports is convenient, but it can conceal serious risks. In AP Cybersecurity, public-network threats and wireless cyberattacks are essential concepts. Here is a breakdown of the key points.

i. Types of Adversaries and Their Motivations

Exam questions often classify adversaries by their capabilities:

• Script kiddies: Low-skilled adversaries who use tools developed by others without understanding how those tools work.
• High-skilled adversaries: Adversaries capable of creating or modifying malicious tools and discovering undocumented vulnerabilities known as zero days.
• Common motivations: Greed, desire for recognition, dedication to a cause, revenge, politics, or beliefs.

ii. Three Common Wireless Cyberattacks

• Evil twin attack: An adversary creates a wireless access point with a service set identifier (SSID) similar or identical to that of a legitimate network—for example, imitating “Guest Wi-Fi” with “Free Guest Wi-Fi.” A user may unknowingly connect to the evil twin, allowing the adversary to capture the user’s network traffic.
• Jamming attack: An adversary floods an area with a strong ElectroMagnetic (EM) signal in the same frequency range as the wireless network. This prevents legitimate traffic between the access point and users. It is a form of Denial-Of-Service (DoS) attack.
• War driving attack: Adversaries detect wireless-network beacons while driving or walking around a target. They can gather information about the network and identify areas where its signal extends beyond the physical building.

iii. Real-World Scenario: The Café Wi-Fi Trap

Scenario: A friend at a café connects to a fake network called “Free Guest Wi-Fi,” while the legitimate network is named “Guest Wi-Fi.” After signing in to a music app, the friend’s password is immediately changed and the account becomes inaccessible.

What happened: The friend connected to an evil twin. The adversary captured unencrypted credentials and used them to change the account password.

iv. How to Protect Yourself on Public Networks

• Verify that the Wi-Fi network’s name exactly matches the network you intend to join.
• Consider the sensitivity of your data before joining an unencrypted Wi-Fi network.
• Consider using a Virtual Private Network (VPN), which encrypts traffic between your device and the VPN operator’s system.
• Disable automatic Wi-Fi connections.
• Confirm that websites use HTTPS, an encrypted protocol.

Exam Tips: For wireless-security questions, remember the pairing of NO EvilTwin (an imitation SSID used to capture network traffic) and a VPN, which provides an encrypted connection to the VPN operator’s system.

Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf

Welcome to Week 2 of our AP Cybersecurity self-study journey! 

Follow these steps to guide your learning and track your progress:

1. Read the official topic. Review the relevant topic in the AP Cybersecurity Course and Exam Description (CED), and use this weekly workbook to track your learning.

2. Study the key concepts. Learn the required content and review the self-study notes posted immediately after the weekly workbook.

3. Demonstrate mastery. Complete each mastery task. Set its Status to Complete only when you can successfully perform the task and clearly explain the underlying concept.

4. Rate your confidence honestly. Before the exam, revisit any completed items with a Confidence rating of Low or Medium.

UNIT 1

TOPIC 1.2  |  Suspicious Website Logins

1.2.A Identify common signs of a password attack.

REQUIRED KNOWLEDGE

[  ] Recognize bursts of failed logins, unusual source addresses or locations, unexpected login times, many accounts targeted from one source, and sequences of common or stolen credentials.

EVIDENCE OF MASTERY / PRACTICE

[  ] Review an authentication log and flag likely brute-force, spraying, or stuffing activity.

UNIT  1 – Introduction to Security	SKILL FOCUS  Detect Attacks
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.2	SELF RATING  1    2    3    4    5

1.2.B Explain how adversaries take advantage of weak authentication.

REQUIRED KNOWLEDGE

[  ] Understand guessing and automated password attacks, reuse of breached credentials, default and common passwords, weak password policies, and single-factor authentication weaknesses.

EVIDENCE OF MASTERY / PRACTICE

[  ] Match each authentication weakness to a plausible attack path.

UNIT  1 – Introduction to Security	SKILL FOCUS  Analyze Risk
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.2	SELF RATING  1    2    3    4    5

1.2.C Explain how to make authentication stronger.

REQUIRED KNOWLEDGE

[  ] Use longer unique passwords or passphrases, password managers, MFA, account lockout or throttling, secure recovery, and elimination of default credentials; explain the security benefit of each.

EVIDENCE OF MASTERY / PRACTICE

[  ] Design a stronger login policy and justify every setting.

UNIT  1 – Introduction to Security	SKILL FOCUS  Mitigate Risk
STATUS  ____________________	CONFIDENCE  ____________________
TARGET DATE  ______________	LAST REVIEWED  ______________
SOURCE  Fall 2026 CED, Topic 1.2	SELF RATING  1    2    3    4    5

SELFSTUDY NOTES

Online password attacks and log analysis are frequently tested topics on the AP Cybersecurity Exam. The following realistic scenario will help you understand these concepts thoroughly.

i. What Is an Online Password Attack?

An adversary attempts to compromise an account by trying common passwords, common password patterns, or stolen passwords in real time.

Three major Indicators of Compromise (IoCs) in authentication logs are:

• Many failed login attempts within a short period: A common sign of a brute-force password attack.
• Login attempts at unusual times: For example, a login attempt at 3:00 a.m. may indicate an automated tool or a remote adversary.
• Login attempts from an unknown device: The attempt originates from a device the user does not normally use.

ii. Practical Authentication-Log Analysis

An exam question may provide a login-activity log and ask you to identify suspicious activity.

• Unexpected geographic location: The user normally logs in from the United States, but an Austrian IP address suddenly appears.
• Unknown device: The log identifies an “Unknown Windows PC.”
• Concentrated failures: Eleven consecutive failed login attempts occur within 15 minutes.
• Most important indicator: A successful login occurs immediately after numerous failed attempts. This may indicate that the adversary has discovered a valid password.

iii. Common Weak Passwords and Defensive Strategies

Common weak-password patterns include:

• A word followed by a year and a symbol: For example, Strawberry2027!
• A pet’s name, birthdate, or simple character substitution: For example, P@ssc0de

Strong Defense: Multifactor Authentication

Enable multifactor authentication (MFA). Authentication factors fall into three categories:

• Something you know: A password or PIN
• Something you have: A phone or security key
• Something you are: A fingerprint or facial recognition

Study Tips

Remember these four elements when analyzing authentication logs:

• An unexpected location or unknown device
• A login attempt at an unusual time
• Many failed attempts within a short period
• A successful login immediately after repeated failures

Official framework: https://apcentral.collegeboard.org/media/pdf/ap-cybersecurity-course-and-exam-description.pdf