AP Cybersecurity Unit 1 Assessment
Multiple Choice
1.
A venue advertises 'Studio-Guest'. A device offers 'Studio-Guest-Help' and 'Studio-Guest' in the network list. What is the best next step before joining?
A. Assume that adding '-Help' proves official ownership
B. Pick the stronger signal because signal strength authenticates the operator
C. Confirm the intended name with venue staff and do not treat the similar name as equivalent
D. Join whichever name has more letters
2.
A message pretending to be a coach asks for a team roster. Which feature establishes a pretext?
A. The claim that the league is updating its eligibility register
B. The size of the attachment
C. The sender's use of an exclamation mark
D. The time the email arrived
3.
An adversary first uses AI to scan public profiles, conference pages, and social-media posts about a company executive. The adversary then uses an AI coding tool to create a script that searches the company's public application for documented vulnerabilities. Which pair of capabilities is being used?
A. AI-assisted reconnaissance and AI-assisted coding
B. Voice authentication and automated corrective response
C. Digital impersonation and training data poisoning
D. Prompt extraction and AI-based threat detection
4.
A station has two access points advertising the same name. One is verified by staff; the other redirects a test device to a counterfeit account form. Which observation best supports an evil twin attack rather than a simple outage?
A. An unauthorized access point imitates the network and solicits credentials
B. The station's official network is sometimes slow
C. Both access points transmit at the same time
D. The test device can detect several unrelated networks
5.
An account alert reports a login the user did not recognize. Which is the safest way to inspect account activity?
A. Reply to the alert with the login code
B. Disable alerts before checking the account
C. Open the service through a known address and inspect the account there
D. Follow the alert's sign-in link and enter the password
6.
A strong password makes multi-factor authentication (MFA) unnecessary. Which of the following best evaluates this statement?
A. True — MFA is only needed for accounts with weak passwords.
B. False — a stolen or guessed password is only one factor; MFA provides an additional layer of protection.
C. False — passwords are always insecure regardless of length.
D. True — a sufficiently long password cannot be guessed or cracked.
7.
A fake video of a manager asks employees to install a program. Which measure best limits the impersonation's success?
A. Ask the video sender for another copy
B. Require software requests to arrive through an independently verified approval workflow
C. Approve any request that includes a video
D. Trust a request if it uses company branding
8.
A staff portal checks a user's password and authenticator code. After login, it permits teachers to view their own classes but denies access to payroll. Which pairing describes these two decisions?
A. First authentication; then authorization
B. First authorization; then authentication
C. Both are encryption
D. Both are availability checks
9.
An AI tool ranks thousands of security alerts. What use best preserves human oversight?
A. Delete evidence from low-ranked alerts automatically
B. Disable all other alert sources
C. Have analysts verify high-priority alerts against underlying evidence
D. Treat ranking as definitive proof of compromise
10.
A fake support message directs users to a counterfeit login page. A tester visits it and enters nothing; the scenario gives no evidence of a download. What can the tester conclude?
A. The counterfeit form must have changed the real service's login settings
B. The page could capture submitted credentials, but the visit alone does not establish that credentials were disclosed
C. Visiting proves that the page received the tester's password
D. The absence of a download proves that the page cannot be used for social engineering
Questions 11–13 refer to the following information.
From: Student Accounts Office fees@oakridge-fees.net
Subject: Graduation account balance
Dear Parent or Guardian, several families have contacted our office about graduation requirements, so we are contacting all families with an outstanding balance. Our records show an unpaid $198.60 laboratory and activities fee. Under district policy, an unpaid balance may prevent a student from receiving a diploma, attending the ceremony, or obtaining an official transcript. The attached notice claims that the fee was recorded during last year's laboratory program. Please pay throughoakridge-fees.net/paywithin 60 hours and keep the confirmation number for your records. For speed, do not call the school's main office; replies to this message are not monitored. Thank you, Student Accounts Office.
The school's published payment site has a different domain, and the message has not been verified.
11.
Which social-engineering tactic is most directly used by the warning that the student might lose graduation privileges?
A. Consensus, because many families received the message
B. Intimidation, because a feared consequence is used to pressure payment
C. Curiosity, because the sender withholds the details of the balance
D. Familiarity, because the sender uses a parent's first name
12.
Which part of the message most clearly establishes a pretext for contacting the parent?
A. The instruction to pay within 60 hours
B. The warning about diplomas and transcripts
C. The claim that several families asked about graduation, so all families with balances are being contacted
D. The link to the payment page
13.
If a parent enters card details into the unverified payment page, which outcome is most likely?
A. The parent's phone is cloned automatically.
B. The attacker obtains the submitted payment information.
C. Every device on the home network is compromised automatically.
D. All social-media accounts are immediately compromised.
14.
A fake contest form collects birthdays and pet names but no passwords. A victim uses their pet's name to answer a recovery question. Which path becomes easier?
A. Impersonating the victim during account recovery
B. Intercepting encrypted packets on the local network
C. Installing a certificate on the victim's browser
D. Disabling the contest site's own login controls
15.
Several clients lose Wi-Fi at the same time. The wired uplink works, and the wireless failure is confined to one band with a strong interfering signal. Which additional observation would most strengthen the interference explanation?
A. The wired printer's name changes
B. Clients on another band continue working near the same access point
C. The same user mistypes an account password twice
D. A web page returns an old cached result
Questions 16–17 refer to the following information.
A student approved an MFA prompt that they did not initiate. Soon afterward, a login from an unfamiliar device succeeded. The student still knows the correct password.
16.
Which conclusion is best supported by the event?
A. A known password proves the account is safe.
B. The successful login may have used a compromised factor or an improperly approved prompt.
C. MFA prevents every unauthorized login, so the event is harmless.
D. The unfamiliar device must belong to the school's help desk.
17.
Which response should the student take first?
A. Report the event through the school's trusted channel and secure the account.
B. Approve later MFA prompts so the account is not locked.
C. Post the login details publicly to ask for help.
D. Disable all account alerts without investigating.
18.
A password used on several websites has appeared in a breach. Which ongoing practice best prevents that single disclosure from exposing the user's other accounts?
A. Use the same password only on important accounts.
B. Keep unique passwords for different accounts, ideally with a password manager.
C. Write the shared password in a public class document.
D. Disable MFA because unique passwords replace it.
19.
A school employee pastes a private student contact list and internal security instructions into an AI assistant. An attacker later designs prompts that cause the model to reveal protected information. Which response best identifies the attack and the protective practice that was missed?
A. AI-assisted coding; require every employee to learn programming.
B. Digital impersonation; verify the employee's voice with MFA.
C. Prompt extraction; do not enter personal or sensitive data into AI-driven tools.
D. Training data poisoning; publish corrected information on more websites.
20.
A student entered a school password into a fake form. Which detail is most useful when reporting it?
A. A guess about the attacker's nationality
B. Only the browser's color theme
C. The address of the form and approximate time, without sending the password
D. The password itself in a public chat
21.
An AI assistant flags untrusted input in two branches of a web handler. Its suggested patch fixes the search branch, but the export branch still uses the same untrusted value in the same way. What should the programmer do?
A. Review both branches and test them independently before adopting the recommendation.
B. Approve the patch because it changes the first branch named in the warning.
C. Close both findings because the two branches share a handler.
D. Ask the monitoring team to suppress alerts for the export route instead of reviewing its code.
22.
Three chatbots recommend the same newly announced payment address for a familiar organization. None can provide trustworthy evidence for the change. Before paying, which action best checks the claim independently?
A. Trust the claim because three AI tools agree.
B. Check the organization’s independently known official website or contact it through an established channel.
C. Submit a small payment to the new address to see whether it is accepted.
D. Ask the first chatbot to express greater confidence in its answer.
23.
A request from a real supplier account asks to change payment instructions. Why verify independently?
A. Email authentication proves every business instruction is genuine
B. A genuine sending account might itself be compromised
C. A real supplier account can never be used remotely
D. Using a reply proves the request is authorized
24.
A captive portal on public Wi-Fi requests the student's school password, although the network is not operated by the school. What should the student do?
A. Decline and verify the network or use a trusted connection
B. Provide the school password but omit the username
C. Provide a backup code instead
D. Assume the portal is trusted because it appeared automatically
25.
A student opens the official school portal. Before displaying the student's records, the portal asks for a password and a one-time code from an authenticator app. What is the portal doing?
A. Checking whether the student's Wi-Fi signal is strong
B. Generating a new password for every visit
C. Deciding whether a received message is phishing
D. Authenticating the student's claimed identity
Questions 26–27 refer to the following information.
A caller sounds exactly like a friend, says their phone was stolen, and requests an immediate money transfer to a new account.
26.
Which type of attack is most likely being used?
A. Phishing
B. Credential stuffing
C. Voice cloning enabled by AI
D. SQL injection
27.
What is the best way to verify the identity of the caller in the preceding scenario?
A. Call back using a trusted phone number or verify through another known channel
B. Trust the caller since the voice sounds identical
C. Ask the caller to send a photo of themselves
D. Ask the caller for personal details, such as their birthdate or pet's name, to confirm identity
28.
A system permits account recovery using voice alone even though normal sign-in requires a security key. Which change addresses the weakness created by a cloned voice?
A. Continue allowing voice-only recovery because normal sign-in is stronger
B. Require independent proof of possession during recovery too
C. Ask the caller to repeat the same voice sample twice
D. Increase the recording volume used in recovery
29.
After authenticating to the school's approved VPN over public Wi-Fi, a staff member receives a message requesting their password on an unfamiliar external page. The VPN protects its tunnel traffic. Which statement best explains why the request still needs checking?
A. The VPN makes all external pages trustworthy, so entering the password is safe.
B. The tunnel protects network traffic, but it does not make a deceptive information request legitimate.
C. Using a VPN disables the need for any account authentication.
D. The public Wi-Fi owner automatically obtains the contents of every protected VPN packet.
30.
A user has three failed login attempts at the normal hour on a familiar device. What can the log establish?
A. Those attempts failed; the log alone does not establish who made them
B. The account was definitely taken over
C. A password database was definitely stolen
D. All later attempts must also fail
31.
An adversary uses AI to scan job postings and staff profiles before sending an email. They select a recipient based on the software mentioned in those postings. What did the AI contribute?
A. Changing the recipient's passwords
B. Proving the email came from the recipient's employer
C. Scaling public-source reconnaissance and target selection
D. Authorizing access to the recipient's inbox
32.
A message promises early access to exam results if the student signs in through an unfamiliar page. What makes this a lure?
A. It blocks unwanted access to the portal
B. It offers a desired benefit to induce action
C. It limits disclosure to an approved channel
D. It supplies proof of the sender's identity
33.
A login history has repeated failures from a new region and one success from the same region five minutes later. The owner says they were at home. Which finding most directly raises concern beyond guessing attempts?
A. The successful login from the same unfamiliar region
B. The existence of a login history
C. The fact that the owner's home login succeeded yesterday
D. The number of records retained by the service
34.
A chatbot repeats an incorrect evacuation instruction found on several websites. Investigators trace the websites to the same deliberately planted false source. Which lesson follows?
A. The websites prove the chatbot independently observed the event
B. Repeating a claim makes it impossible for an attacker to plant it
C. Agreement across repeated sources does not independently verify the instruction
D. The instruction is correct because the tool found multiple copies
35.
A school wants rapid AI-assisted response. Its policy lets an automation open an incident ticket on suspicion but requires staff approval before disabling accounts. An AI alert is uncertain. Which action follows the policy?
A. Disable every flagged account immediately
B. Delete the alert because the model is uncertain
C. Approve the disabling action automatically using the same alert as proof
D. Open a ticket with the supporting evidence and leave the account active pending approval
36.
An analyst notices the model misses phishing messages written in a language rare in its examples. What is the most useful response?
A. Suppress all alerts in that language
B. Stop recording emails in that language
C. Test the detector on representative messages and review blind spots
D. Assume missing alerts mean no attacks occurred
Questions 37–39 refer to the following information.
From: "Campus Tech Support" support@campus-portal.netSubject: URGENT: Your student account requires immediate verification
Your account has been flagged for unusual activity. To prevent suspension, you must verify your identity within 24 hours.
We noticed this while reviewing registration activity for your robotics club account.
Click here to verify: http://campus-portal.net/verify
— Campus Tech Support
37.
Which psychological trigger is used when the email warns that the account will be suspended?
A. Intimidation
B. Urgency
C. Curiosity
D. Politeness
38.
The attacker used generative AI to personalize this message and write it in fluent English. Which of the following best explains how AI strengthens this phishing attack?
A. AI automatically bypasses MFA after the student opens the email.
B. AI proves that the sender controls the real campus domain.
C. AI can quickly create convincing, personalized messages without the language errors that once warned users.
D. AI guarantees that the malicious link cannot be detected by a browser.
39.
Which psychological trigger is most prominently used in the subject line of this email?
A. Politeness
B. Intimidation
C. Curiosity
D. Urgency
40.
A user connects to open Wi-Fi. The login application encrypts its web requests, but the device sends ordinary DNS queries before connecting. What can a nearby observer still potentially learn?
A. The private key stored on the website's server
B. Every locally stored file on the device
C. Which hostnames the device asks the DNS resolver about
D. The plaintext password inside the encrypted application request
41.
A caller knows information from a student's public profile and sounds like their parent. Why is this not sufficient proof of identity?
A. Personal details are equivalent to a registered security key
B. The details can be collected and the voice can be imitated
C. Public facts are known only to the parent
D. A familiar voice guarantees an unmodified recording
42.
A student does not publish their passphrase, but posts their pet's name and adoption date. Their password is formed by joining those two values. What would make targeted guessing less effective?
A. Reverse the two public values and keep them as the whole password
B. Add the same public facts to the recovery hint
C. Use those values again on a less important service
D. Replace it with a long passphrase unrelated to the published facts
43.
A caller whose voice resembles the principal asks a finance employee to make a confidential, urgent payment and supplies a new callback number. Given that voices can be AI-generated, which response best verifies the request?
A. Make the payment because a recognizable voice establishes the caller’s identity.
B. Call the new number supplied by the caller and accept its confirmation.
C. Contact the principal through an independently known channel before authorizing the payment.
D. Ask the caller to repeat the request louder so that AI imitation becomes impossible.
44.
A synthetic image depicts an administrator displaying a badge. Which control reduces reliance on that image?
A. Ask the sender to crop the badge
B. Treat image quality as proof of identity
C. Disable independent verification for familiar faces
D. Verify authorization using the organization's official workflow
45.
A service requires a password and then asks the user to enter a memorized PIN. Why is this not necessarily multifactor authentication?
A. A PIN cannot be used to authenticate anyone.
B. Both checks use something the user knows.
C. Multifactor authentication requires two passwords of equal length.
D. Authentication cannot contain more than one step.
46.
A thief has a student's password but not their registered security key. Why might the sign-in fail?
A. The password became a biometric factor
B. The site disabled authorization for every student
C. Knowing one factor automatically satisfies both checks
D. The possession factor remains unsatisfied
47.
A firewall applies the first matching rule in order from top to bottom. An AI configuration reviewer proposes placing an HTTPS allow for any source above an existing deny for a contractor subnet. The policy requires HTTPS for employees but denies it for contractors. What should the technician conclude before applying the change?
A. It is enough to rename the rule so it describes employee access.
B. The earlier allow would also match contractors; narrow it to authorized sources or preserve the earlier deny.
C. The contractor deny still wins because it is more specific.
D. The new rule is safe because HTTPS encrypts the connection.
48.
A professional-looking login page uses the URL g00gle.com instead of google.com. This technique relies on users:
A. Not updating their browser regularly
B. Not checking the domain name carefully before entering credentials
C. Not having a strong enough password
D. Not using two-factor authentication
49.
An AI-written message contains no spelling mistakes. What remains a useful way to assess it?
A. Verify the requested action through a known channel
B. Treat polished writing as proof the sender is legitimate
C. Reject only messages with grammatical errors
D. Use the link in the message to verify the sender
50.
What does a VPN on a shared network protect most directly?
A. A device from all software vulnerabilities
B. Traffic carried through the encrypted tunnel
C. The contents of a screen from nearby observers
D. Every file after the user uploads it to an untrusted site
51.
Which login combination uses two different categories of authentication factors?
A. A password and a memorized PIN
B. Two separately memorized passphrases
C. A password and a security question
D. A memorized passphrase and a registered security key
52.
An AI-powered security scanner produces the following alert after reviewing uploaded files:
analysis_window: 00:04:32
total_files_scanned: 1,120,000
files_flagged_as_suspicious: 310
minimum_alert_threshold: 82%
top_indicators:
- compressed archives with executable payloads
- patterns similar to previous malware clusters
- rapid upload activity
recommended_action: isolate flagged files and ask analysts to review them
Why is AI most useful in this task?
A. It sorts files only by their names and sizes.
B. It reviews a large volume of files faster than people can, while analysts still evaluate alerts.
C. It guarantees that no legitimate file is ever flagged.
D. It removes the need for any human review.
53.
A fake help desk claims all teammates have already shared their backup codes. What is the claim meant to exploit?
A. Social proof
B. Encryption
C. Password complexity
D. Physical access
54.
A voice message imitates a teacher and asks for an exam answer key. Which check does not depend on judging the audio?
A. Contact the teacher using the established school directory
B. Listen for an accent
C. Ask the sender to speak again on the same channel
D. Accept the request if the voice sounds calm
55.
An attacker uses AI to rewrite a phishing message in each recipient's preferred language. What advantage does the AI provide?
A. It makes the links safe to open
B. It makes tailored messages easier to produce at scale
C. It proves the sender is authorized
D. It removes the need for a delivery channel
56.
A stranger joins a class chat and asks for student IDs, claiming to be a substitute teacher. What is the safest useful response?
A. Check the claim with the school before sharing IDs
B. Share IDs without names
C. Ask the stranger to identify another student
D. Forward the roster to everyone so the class can decide
57.
A student asks an AI assistant to recommend school security software. The assistant confidently repeats a false product claim and malicious link that an attacker planted across public forums before the model was trained. Which response best identifies the attack and the safest next step?
A. Prompt extraction; enter more school information so the model can correct itself.
B. Training data poisoning; verify the recommendation with a reputable, stable, non-AI source.
C. AI reconnaissance; trust the link because the assistant used several public sources.
D. Digital impersonation; enable voice authentication before downloading the software.
58.
A message says a scholarship application will close in ten minutes. Which modification removes the time pressure without changing the claimed sender or the requested data?
A. Threaten to cancel all applications regardless of response time
B. Remove the deadline and the instruction to respond immediately
C. Replace the sender's display name with another official title
D. Replace the requested student number with an email address
59.
An attacker asks an assistant to repeat confidential notes that another user supplied. Which risk does the attacker exploit if the assistant reveals them?
A. The tool converted the notes into a biometric factor
B. Sensitive content supplied to the tool can be elicited through crafted prompts
C. The assistant must have guessed the user's account password
D. The notes were necessarily encrypted under the attacker's key
60.
An analyst compares the candidate lists 'Winter2024!, Winter2025!, Winter2026!' and three independently generated passwords. Why is the seasonal list a useful guess sequence for an attacker?
A. It exploits a predictable change in an otherwise repeated pattern
B. It guarantees that every account uses the same password
C. It is necessarily longer than every generated password
D. It reveals which device the owner normally uses
61.
A campus finds a publicly posted map of wireless names and signal strength outside each building. No association with the access points is recorded. Which activity could have produced the map?
A. Copying a badge at the main entrance
B. Changing each access point's network name remotely
C. Passively observing wireless advertisements while moving around campus
D. Trying every password against each account
62.
A caller asks a user to read out a code while the caller tries to sign in elsewhere. The password was already stolen. What does the caller gain by receiving the code before it expires?
A. A permanent copy of the authenticator's secret
B. The ability to change the site's encryption algorithm
C. A guarantee of access after the code expires
D. The remaining evidence needed for that sign-in
63.
A school wants to use AI to summarize incident logs. Which approach limits exposure of student data?
A. Remove unnecessary identifiers and use an approved tool
B. Submit full student records to any public chatbot
C. Paste account passwords so summaries are more accurate
D. Publish the raw logs before summarizing them