AP Cybersecurity Exam Info
Download PDFThe May 2027 exam is fully digital in Bluebook. Section I has 60 multiple-choice questions in 80 minutes (70%). Section II has one free-response question in 50 minutes (30%). The free-response question combines several sources about a single device, such as security policies, firewall settings, file permissions, and logs. Cite the supplied evidence when explaining security issues or the effect of a configuration change. Hands-on course activities remain part of preparation; the published AP score has these two exam sections.
APFive provides original practice material aligned to course skills. These practice questions are not official College Board exam questions or a substitute for required course projects and performance tasks.
Current course and assessment information:
AP Cybersecurity Exam
The May 2027 exam is fully digital in Bluebook. Section I has 60 multiple-choice questions in 80 minutes (70%). Section II has one free-response question in 50 minutes (30%). The free-response question combines several sources about a single device, such as security policies, firewall settings, file permissions, and logs. Cite the supplied evidence when explaining security issues or the effect of a configuration change. Hands-on course activities remain part of preparation; the published AP score has these two exam sections.
Exam Components
Section I: Multiple Choice
Individual questions and sets of two, three, or four assess risks, controls, suspicious activity, and digital evidence. Apply cybersecurity concepts to career-related scenarios and explain the relevance of observations.
Section II: Free Response
Read multiple sources about one device, connect evidence across policies, firewall rules, permissions, and logs, and justify conclusions about attacks or proposed changes. An unusual event is evidence to investigate; it does not by itself prove compromise.
- Analyze threats, vulnerabilities, likelihood, and impact
- Select and justify risk mitigations
- Interpret logs and other digital evidence to detect attacks
- Collaborate and communicate an evidence-based security recommendation
Units
Unit 1: Introduction to Security
Recognize social engineering and authentication attacks, evaluate adversaries and impacts, and consider the use and limits of AI in cyber defense.
- Social engineering and suspicious logins
- Authentication and password protection
- Cyber adversaries and risk
- AI in cybersecurity and human verification
Practice application: Review a synthetic login record, distinguish an observation from a conclusion, and recommend an appropriate next step.
Unit 2: Securing Physical Spaces
Analyze physical vulnerabilities and select layered preventive and detective controls for a location.
- Physical vulnerabilities, threats, and impacts
- Administrative, physical, and technical safeguards
- Access control, visitor procedures, and least privilege
- Detecting and investigating physical breaches
Practice application: Compare a visitor log and access events to identify a concern and justify a practical physical control.
Unit 3: Securing Networks
Protect network communication with appropriate policies, wireless security, segmentation, and firewalls, and interpret evidence of network attacks.
- Network vulnerabilities and attacks
- Managerial controls and secure wireless networking
- Network segmentation and firewall rules
- Network logs and indicators of compromise
Practice application: Use a supplied network policy and rule table to determine whether a connection should be allowed.
Unit 4: Securing Devices
Reduce device risk with authentication, permissions, updates, and malware defenses, and correlate device events during investigation.
- Device vulnerabilities and attacks
- Authentication, account access, and permissions
- Malware defenses and security updates
- Detecting attacks on devices
Practice application: Correlate an authentication log and a file-access record, explain their limits, and propose a device safeguard.
Unit 5: Securing Applications and Data
Protect applications and data with appropriate access controls and cryptography and recognize evidence of common application attacks.
- Application and data vulnerabilities
- Authorization and least privilege
- Cryptography, confidentiality, and integrity
- Application logs and attack detection
Practice application: Compare a permission table and application log to explain an access problem and justify a corrective control.