AP Cyber 1.1 - 1.4 Vocab

social engineering

attack that manipulates a person— not a system— using psychological tactics like fear or time pressure

phishing

social engineering by email; the adversary tries to get you to click a link, download a file, or send information

elicitation

Tricking someone into revealing sensitive information (often through casual

conversation that doesn't feel like an interrogation).

intimidation

Tactic that threatens a target with negative consequences if they don't comply.

urgency

tactic that pressures the target to act before they have time to think

one-time password

a short code sent to a phone or app to confirm a login; valuable to adversaries because it grants account access

malware

software designed to harm a device or steal from it; often delivered via a malicious download or link

credential capture

stealing a username and password, often by tricking a user into entering them on a fake login page

online password attack

An adversary tries to log in to a real account by submitting many

candidate passwords — usually automated.

dictionary attack

A password attack that submits a pre-built list of likely passwords (often

constructed from personal info about the target).

brute-force attack

A password attack that systematically tries many possible characters

until a password matches.

multifactor authentication (MFA)

Requiring more than one proof of identity to log in — typically password + one-time code or authenticator app; defeats voice-cloning attacks against voice-auth systems.

password manager

Software that generates and stores long random passwords so users

don't need to memorize or reuse them.

passphrase

A long password built from multiple random words; long enough to resist

automated guessing

login log

A record of authentication attempts (successful + failed) used to detect

unauthorized access.

wireless access point

The device that broadcasts a Wi-Fi signal and connects wireless devices to

a wired network

SSID

Service Set Identifier — the human-readable name a wireless network

broadcasts.

evil twin

a rogue wireless access point with an SSID similar or identical to a real network, used to capture victim traffic

jamming attack

a wireless DoS attack that uses strong EM signals to block legitimate WiFi traffic

war driving

reconnaissance technique where the adversary scans for wireless networks while moving past the target

zero-day

a previously undocumented vulnerability — no patch exists at time of discovery

VPN

virtual private network —- encrypts traffic from a device to the VPN operator’s system

DoS

Denial of Service — any attack that prevents legitimate users from accessing a resource

deepfake

AI-generated synthetic audio, image, or video designed to impersonate a real person

voice cloning

using AI to generate a target’s voice from a few minutes of audio samples — used in phone-based impersonation attacks

large language model (LLM)

an AI system trained on large text corpora that can generate fluent text in any language; used by adversaries to craft phishing at acale

prompt injection/extraction

crafted prompts that trick an LLM into revealing secrets from its training data or user inputs

training-data poisoning

planting false information on the web so it ends up in LLM training sets and the LLM repeats it

AI-powered reconnaissance

automated AI tools that scrape social media and public websites to build a profile of a target

shared secret word

a pre-agreed word/phrase between two people, used to identify in high-stakes moments