AP® practice test

Free AP® Cybersecurity Practice Test (2026)

This is a set of 25 original practice questions that follow the official AP® Cybersecurity course outline and its skill weights, each with a short explanation. The exam weights its multiple-choice section by three skills instead of by unit, so the questions are grouped by skill and drawn from all five units of the course.

  • 25 questions
  • 3 topics from the official outline
  • No timer
Start the test

Free. Create a free account to see your score.

The practice test

25 questions

Question 1 of 25An employee gets a call from someone who says, "Hi, this is Sam from the IT help desk. We're moving everyone's mailbox to a new server tonight, and I need your username and password so your old messages come across." Which social engineering technique is the caller mainly using?
Question 2 of 25A small online store buys an insurance policy that will pay the costs of a data breach, such as legal fees and customer notifications. Which risk response is this?
Question 3 of 25A network monitor shows that, within one second, the server at 192.168.10.25 received about 4,800 ICMP echo replies from 250 different devices on its own network, although the server sent no echo requests. Which attack do these records most likely show?
Question 4 of 25A student breaks into the school's grading system and raises several grades. The system stays online and nothing is deleted. Which part of the CIA triad does this attack most directly violate?
Question 5 of 25A system administrator runs chmod 754 report.sh on a Linux system. Which of the following describes the file's permissions afterward?
Question 6 of 25A company's security team believes adversaries are likely to try new attacks that have never been seen before, and a hybrid detection system costs more than the company can pay. Which network detection method should it choose, and why?
Question 7 of 25A group with no connection to an oil company breaks into the company's servers and posts its internal emails online to expose pollution it has hidden. The group asks for no money. Which type of adversary is this most likely to be?
Question 8 of 25An authentication log shows that, over 20 minutes, one IP address made a single failed login attempt on each of 300 different user accounts, using the same password, Winter2026, every time. Which attack does this pattern indicate?
Question 9 of 25Which of the following login methods uses two different categories of authentication factor?
Question 10 of 25During a risk assessment of a school, an analyst finds that its web server runs software with a known security flaw that has not been patched. How should the analyst classify the unpatched flaw?
Question 11 of 25A company places a file named payroll_all_staff.xlsx on a file server. The file contains fake salaries and bank details, no employee needs it, and any attempt to open it sends an alert to the security team. What is this file?
Question 12 of 25Why do password systems add a unique random value, called a salt, to each user's password before hashing it?
Question 13 of 25A person carrying a large stack of boxes walks up to the locked door of an office and asks an employee to hold the door open, and the employee does. The person has no badge. Which physical attack does this describe?
Question 14 of 25A company's public website must be reachable from the internet, but its internal HR database must not be. Where should the company place the web server?
Question 15 of 25Last month a system administrator recorded the SHA-256 hash of the file firewall.conf. Today, running sha256sum on the file gives a different value. What is the best conclusion?
Question 16 of 25At an airport, an adversary sets up a wireless access point that broadcasts the same network name as the airport's free Wi-Fi, so that travelers' devices connect to it and their traffic passes through the adversary's device. Which attack is this?
Question 17 of 25A security analyst reviews three records for a lab door on the same evening. The badge log shows one swipe, by employee J. Ortiz, at 21:14:05. The door sensor shows the door open from 21:14:06 to 21:14:41. Camera footage shows two people walking through the door, at 21:14:10 and 21:14:15. Which conclusion do these records best support?
Question 18 of 25A firewall checks inbound traffic against these rules in order and applies the first rule that matches. Rule 1: Allow, inbound, TCP, port 443, source ALL. Rule 2: Deny, inbound, TCP, all ports, source 203.0.113.0–203.0.113.255. Rule 3: Deny all other traffic. What happens to an inbound TCP connection to port 443 from 203.0.113.50?
Question 19 of 25A programmer adds hidden code to a company's payroll system that will delete all payroll records if the programmer's name is ever removed from the employee list. What type of malware is this?
Question 20 of 25Lena wants to send a public announcement that anyone can check really came from her and was not altered. She attaches a digital signature. Which key does Lena use to create the signature?
Question 21 of 25A web server log shows a request to the login page whose username field contains 4,096 copies of the letter A, and right after it the web application crashes. Which application attack does this evidence most likely indicate?
Question 22 of 25A user posts a comment on a school forum that contains a script. Afterward, the script runs in the web browser of every person who views the comment. Which attack is this?
Question 23 of 25A server's only job is to host a company's website. A scan shows that it is also running Telnet and FTP services that no one uses. Which action best reduces the server's risk?
Question 24 of 25Over three weeks, an adversary copied customer files from a company's servers. The company's detection system never raised an alert, and the theft was found only during an audit. What does the detection system's silence represent?
Question 25 of 25An employee receives a phone call in a voice that sounds exactly like the company's CEO, telling them to send an urgent wire transfer. The voice was generated by AI from recordings of the CEO's public speeches. Which AI-powered attack is this?

Your answers save on this device as you go.

More free AP practice tests 35

Each has 25 questions written from the exam's official outline. Your answers on each test save separately.

Not sure where to start?

Ask Iris, our AI assistant, which exams your college takes and which guide fits. A person on our team answers at team@transfercredit.org.

Find my college

These are practice questions we wrote from the official outline. This is not the real exam, and a practice score doesn't predict your AP score. We source all of this information from College Board. Each college decides whether to award credit for an AP exam, so confirm with your registrar before you book an exam. AP® is a registered trademark of the College Board, which was not involved in making these questions and does not endorse TransferCredit.org. Terms