AP® Cybersecurity study guide: a printable PDF built from the College Board's official course and exam description, in the official order.
Last updated 2026 · exam details checked against the College Board's published exam information in 2026
Real pages from the 36-page PDF.
One chapter for each area of the official course and exam description, in the official order.
Multiple-choice questions taken from the guide's chapter quizzes: 3 areas, heaviest first. About 15 minutes, with every answer explained and a score by area. The exam's free-response questions aren't in this quiz: see how the exam works.
Answer: C. Authority. The claimed council position is used as a reason to obey. The message does not claim that peers complied or threaten a consequence.
The trap: Intimidation would involve a threatened negative consequence; the stated message relies on a title.
The claimed council position is used as a reason to obey. The message does not claim that peers complied or threaten a consequence.
The trap: Intimidation would involve a threatened negative consequence; the stated message relies on a title.
Answer: D. Residual risk after mitigation. The lock is a mitigation. Exposure that remains afterward is residual risk, which management must evaluate rather than assume acceptable.
The trap: Risk transfer to the cabinet manufacturer would require shifting a burden under an actual arrangement; installing a lock does not do that.
The lock is a mitigation. Exposure that remains afterward is residual risk, which management must evaluate rather than assume acceptable.
The trap: Risk transfer to the cabinet manufacturer would require shifting a burden under an actual arrangement; installing a lock does not do that.
Answer: B. Have a detection engineer validate the rule against relevant benign and malicious cases.. Expert validation can reveal both missed attacks and unnecessary alerts before the rule affects monitoring. A filename alone does not establish legitimacy.
The trap: Approve the rule because of a familiar filename assumes a name proves the program is trustworthy; malicious files can use familiar names.
Expert validation can reveal both missed attacks and unnecessary alerts before the rule affects monitoring. A filename alone does not establish legitimacy.
The trap: Approve the rule because of a familiar filename assumes a name proves the program is trustworthy; malicious files can use familiar names.
Answer: A. Increase the assessed likelihood of exploitation.. A ready-made tool lowers the skill needed and increases the set of potential adversaries. Nothing in the scenario changes the consequence of a successful attack.
The trap: Increase the amount of data exposed is unsupported: the affected data and possible damage have not changed.
A ready-made tool lowers the skill needed and increases the set of potential adversaries. Nothing in the scenario changes the consequence of a successful attack.
The trap: Increase the amount of data exposed is unsupported: the affected data and possible damage have not changed.
Answer: A. The HTTPS message contents. The VPN operator can remove the tunnel’s encryption, but the independent HTTPS encryption remains between the browser and the website’s TLS endpoint.
The trap: The timing of packets passing through the VPN endpoint remains visible as metadata; encryption does not hide every connection characteristic.
The VPN operator can remove the tunnel’s encryption, but the independent HTTPS encryption remains between the browser and the website’s TLS endpoint.
The trap: The timing of packets passing through the VPN endpoint remains visible as metadata; encryption does not hide every connection characteristic.
Answer: C. Review recorded camera coverage at that entrance and time.. The 27-second opening is unusual and warrants checking visual evidence. Neither its duration nor a single badge event establishes the number or authorization of entrants.
The trap: Declare that exactly two people entered invents a count that the door sensor and badge record do not provide.
The 27-second opening is unusual and warrants checking visual evidence. Neither its duration nor a single badge event establishes the number or authorization of entrants.
The trap: Declare that exactly two people entered invents a count that the door sensor and badge record do not provide.
Answer: D. It narrows the plausible passwords worth trying online.. Personal details and predictable structure help build likely guesses. The attacker still has to try credentials; the information does not itself grant access.
The trap: It authorizes a session confuses useful guessing information with successful authentication.
Personal details and predictable structure help build likely guesses. The attacker still has to try credentials; the information does not itself grant access.
The trap: It authorizes a session confuses useful guessing information with successful authentication.
Answer: B. Approved-server EAP authentication, WPA3 protection and adjusted antenna direction and power. EAP can authenticate individual staff through an approved server; strong WPA3 protection encrypts frames, and antenna adjustments reduce unnecessary coverage.
The trap: One shared staff password, WPA3 and adjusted antenna direction and power protects frames and controls coverage, but a shared credential does not provide individual staff accounts.
EAP can authenticate individual staff through an approved server; strong WPA3 protection encrypts frames, and antenna adjustments reduce unnecessary coverage.
The trap: One shared staff password, WPA3 and adjusted antenna direction and power protects frames and controls coverage, but a shared credential does not provide individual staff accounts.
Answer: A. Anomaly-based detection. Anomaly detection can flag deviations from the clean, consistent baseline without requiring a signature for that particular attack. It still needs tuning and investigation.
The trap: A combined signature-and-anomaly system is hybrid monitoring, which the stated budget cannot support.
Anomaly detection can flag deviations from the clean, consistent baseline without requiring a signature for that particular attack. It still needs tuning and investigation.
The trap: A combined signature-and-anomaly system is hybrid monitoring, which the stated budget cannot support.
Answer: D. Training-data poisoning. The adversary contaminates material intended for model training so the resulting model repeats misinformation.
The trap: Sensitive prompt-data extraction tries to obtain protected information from an AI system; it does not describe corrupting the training material.
The adversary contaminates material intended for model training so the resulting model repeats misinformation.
The trap: Sensitive prompt-data extraction tries to obtain protected information from an AI system; it does not describe corrupting the training material.
The AP® Cybersecurity exam is from the College Board. It has 60 multiple-choice questions, plus 1 free-response question. You get 80 minutes for multiple choice; 2 hours 10 minutes in all, no calculator. The score scale is 1–5 (AP® score scale; your college decides credit). The guide has 3 chapters, one for each area of the official course and exam description; its 3 units carry the same weight (25–40% each).
Source: official AP® Cybersecurity page and the official course and exam description. Last updated 2026.
3 chapters, in the official order, with each area's official weight. The guide's chapters follow this order.
Where to start: Each tested skill accounts for 25–40% of multiple-choice questions; the ranges do not imply equal actual counts. Use the self-check to target gaps across all five content units, then practice combining evidence from one device.
The heaviest area is open to read now. The full guide has a chapter for every area, each with all its terms, a quiz and an answer key.
Start with what has value, what could harm it, and the weakness that makes harm possible. Assess both likelihood and impact before choosing a risk rating. These topics support all three exam skills, even though their definitions appear here.
Key terms, with examples
What this area covers
How the exam asks it
Expect an asset, a weakness, and a possible adversary action. Identify the mechanism, connect it to confidentiality, integrity, or availability, and use the stated circumstances to judge likelihood and impact. Attack phases need not all occur or follow one rigid sequence.
Common traps
Trap 1. A familiar sender name, polished writing, or convincing voice does not authenticate a request. Evaluate what the message asks you to do.
Trap 2. A vulnerability is a weakness; a threat can exploit it. A serious consequence alone does not establish that exploitation is likely.
Trap 3. Attack mechanisms can overlap. Identify the feature the question specifies instead of assuming that every wireless or application attack works the same way.
Memory trick
For a risk note, ask: valuable what, vulnerable how, threatened by whom, harmful how?
Trace an intrusion as learn → enter → remain → expand → act → hide; use the evidence, not a mandatory sequence.
The exam has 60 multiple-choice questions, plus 1 free-response question. The guide sorts the questions into 5 types; spot the type and you'll know what the question wants before you read the choices.
A scenario asks you to distinguish an asset, a threat, an exploitable weakness, and the likely consequences.
You choose a protection that addresses a stated weakness while meeting operational constraints.
A short configuration asks what a particular connection or access request will do.
Logs, tool outputs, or detection results support a bounded conclusion about events or monitoring.
The real task is a typed response using multiple sources from one simulated device. This small multiple-choice example practices planning only.
Pacing: 60 questions in 80 minutes, about 80 seconds a question.
Try the first 8 cards free. Read the term, say the definition out loud, then select the card to check yourself. Arrow keys move between cards.
Follow the steps, then enter your test date. The planner gives you a dated plan that starts with the heaviest areas and saves the last days for review.
Everything on this page is free with no account. The full guide is a PDF you keep.
| Study tool | This page | Full study guide ($5) |
|---|---|---|
| Chapters | A preview of 1 of 3 | All 3 |
| Terms explained | A sample from the open chapters | All 235, each with an example |
| Practice questions | 10 free questions | 39, with an answer key |
| Flashcards | 8 cards | All 235 terms on the self-check list |
| Study plan | Dated planner | 2-, 4- and 8-week plans |
| Cram sheet | — | 2 pages, for the night before |
| Format | Web page | 36-page PDF, printable |
We built one chapter for each area of the College Board's official course and exam description for AP® Cybersecurity, using its published weights to order the chapters and size the quizzes. Each chapter was written, then fact-checked against the official exam information in a separate review. The exam details were checked against the College Board's published exam information in 2026.
Sources: official AP® Cybersecurity page, official course and exam description. Last updated 2026.
AP® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this guide. TransferCredit.org is independent and not affiliated with the College Board. © 2026 UPI Globale Edu Inc.
Ready for the full AP® Cybersecurity guide? 36 pages, 235 terms, 39 practice questions and a 2-page cram sheet, $5.
Get the guide · $5