AP Cybersecurity Course and Exam Description Study Guide

Guiding Principles of the Advanced Placement Program

AP stands for clarity and transparency: The Advanced Placement Program provides public course frameworks and sample assessments to ensure teachers and students have clear expectations for demanding work.
AP is an unflinching encounter with evidence: Courses enable students to develop as independent thinkers, using the scientific method as a starting point to draw their own conclusions.
AP opposes censorship: The program respects intellectual freedom. If a school bans required topics, the AP designation is removed. An example provided is college biology, where the concepts of evolution are essential; a course neglecting them cannot be titled AP Biology.
AP opposes indoctrination: Students are expected to analyze perspectives different from their own. No points are awarded on the AP Exam for agreeing with a specific viewpoint. The goal is to assess source credibility and draw independent conclusions.
AP courses foster an open-minded approach to histories and cultures: Essential study of nationalities, cultures, religions, races, and ethnicities is grounded in primary sources for student evaluation.
Respect for every student: Students are encouraged to evaluate arguments, not one another. Diversity in backgrounds and experiences is respected, and personal attacks have no place in the classroom.
AP is a choice for parents and students: Participation is voluntary. Expert committees of professors and educators craft materials, which are validated by the American Council on Education.

Overview of the AP Program and Course Development

Academic Pursuit: AP enables students to pursue college-level studies in high school, offering opportunities for college credit or advanced placement.
Global Recognition: Over $3,300$ institutions worldwide receive AP scores annually. Research indicates students scoring a $3$ or higher typically experience greater academic success in college.
Course Audit: Schools must participate in the AP Course Audit where college faculty review syllabi to ensure they meet college-level expectations before the "AP" label is authorized.
Exam Development: A multiyear process involving committees of college faculty and expert teachers ensures questions are accurate and valid. This includes extensive review, piloting, and analysis.
Scoring Standards: - $5$ : Extremely well qualified (College Grade Equivalent: $A$ ) - $4$ : Well qualified (College Grade Equivalent: $A-, B+, B$ ) - $3$ : Qualified (College Grade Equivalent: $B-, C+, C$ ) - $2$ : Possibly qualified - $1$ : No recommendation
Criterion-Referenced Grading: AP Exams are not graded on a curve. Every student who meets the criteria for a specific score receives it.

AP Career Kickstart and Professional Support Resources

Purpose: AP Career Kickstart courses prepare students for high-skill, high-growth careers by providing instruction in technical and professional skills grounded in authentic scenarios.
Industry Alignment: Developed in partnership with industry leaders and CTE (Career and Technical Education) specialists, these courses allow students to earn employer-endorsed credentials.
AP Classroom: A dedicated online platform providing year-long support, including unit guides, practice tests, and reports.
Unit Guides: Planning guides that outline required content and skills, suggested pacing, and exam tips.
Lesson Plans: Hands-on lessons connecting learning to professional experiences.
Professional Skills Framework: Supports growth in communication, teamwork, and critical thinking using collaboration rubrics.
Bluebook and Reporting: Students take timed practice tests in the Bluebook app, and teachers view class trends via the Reports feature.

The AP Cybersecurity Course: Framework and Instructional Strategy

Course Description: A year-long intro course equivalent to a one-semester college introduction to cybersecurity. It aligns with the NICE Workforce Framework.
Domains of Study: Students explore vulnerabilities, attacks, mitigations, and detection across physical spaces, networks, devices, applications, and data.
Legal and Professional Norms: Professional practice is guided by norms from organizations like ISC2 and government bodies like the UK Cyber Security Council.
Data Regulations: - Personally Identifiable Information (PII): Includes biometric data like voice recordings and fingerprints. - Protected Health Information (PHI). - Student education records. - Financial records (e.g., $PCI\,DSS$ : Payment Card Industry Data Security Standard).
Skills Overview: - Skill Category 1: Analyze Risk (Evaluate risk to assets). - Skill Category 2: Mitigate Risk (Implement protective and deterrent controls). - Skill Category 3: Detect Attacks (Implement monitoring and analyze evidence). - Skill Category 4: Collaborate (Work with others and AI to accomplish tasks).

Unit 1: Introduction to Security - Vulnerabilities and Social Engineering

Social Engineering Tactics: Psychological manipulation to get users to reveal sensitive information (elicitation), download malicious files, or click links. Tactics include: - Intimidation: Threatening negative consequences for non-compliance. - Urgency: Creating time-sensitive pressure to prevent careful consideration.
Impacts for Victims: - Loss of personal info (name, birthdate) used for challenge questions. - Compromised One-Time Passwords (OTP). - Malware installation via links or downloads.
Password Attacks: Adversaries use common patterns (e.g., family names + significant dates + special characters). - Signatures of attack: Many failed attempts, unusual times, or unknown devices. - Countermeasure: Multifactor Authentication (MFA) and using random, unique passphrases stored in a password manager.
Public Network Risks: - Evil Twin Attack: An adversary sets up a Wireless Access Point (WAP) with a similar SSID to capture traffic. Note: Adversaries cannot read traffic using encrypted protocols like $HTTPS$ . - Jamming Attack: Flooding an area with electromagnetic (EM) signals to prevent legitimate traffic (a form of Denial of Service, or DoS). - War Driving: Searching for wireless network beacons while moving around a target to gather network properties. - Protection: Verify SSIDs exactly; use a Virtual Private Network (VPN) for unencrypted Wi-Fi.
AI-Based Threats: - Adversaries use AI to clone voices or create digital avatars for impersonation (Scenario 1D). - Large Language Models (LLMs) used to create grammatically perfect phishing emails in any language. - Use of LLMs for reconnaissance or to help write new malware code.
AI-Based Defense: - AI tools analyze code for vulnerabilities and suggest sanitization/validation rules. - AI helps sort through millions of digital events to identify malicious patterns faster than humans.

Unit 2: Securing Spaces - Foundations of Risk Management

Cyber Foundations: - Pretexting: Creating a believable reason to contact a target. - Authority: Impersonating a powerful figure. - Consensus: Creating social pressure ("everyone else is doing it"). - Familiarity: Pretending to know someone close to the target.
Adversary Types: - Script Kiddies: Low-skilled, use existing tools, motivated by greed/ego. - Hacktivists: Motivated by social/political causes. - Insider Adversaries: Have legitimate credentials; potentially recruited by 3rd parties. - Cyberterrorists: Seek to disrupt civil infrastructure (power grids, water plants). - Transnational Criminal Organizations: Deploy ransomware and steal Intellectual Property (IP).
Phases of a Cyberattack: (i) Reconnaissance, (ii) Initial Access, (iii) Persistence, (iv) Lateral Movement, (v) Taking Action, (vi) Evading Detection.
Risk Assessment Methodology: - Risk = Threat $\times$ Vulnerability ( $Risk \text{ occurs when a threat exploits a vulnerability to compromise an asset}$ ). - Severity Factors: Financial cost, reputational damage, operational impact.
Risk Management Strategies: (i) Avoid (stop activity), (ii) Transfer (insurance), (iii) Mitigate (apply controls), (iv) Accept (residual risk).
Control Types: - Physical: Locks, fences, guards, bollards. - Technical: Firewalls, anti-malware, encryption. - Managerial: Policies, user training, Incident Response Plans (IRPs).
Defense-in-Depth: A layered strategy implementing protection at human, physical, network, device, and application levels.
Physical Attack Methods: - Piggybacking: Using social engineering to get an authorized person to hold a door open. - Tailgating: Following closely behind an authorized person without their knowledge. - Shoulder Surfing: Watching a user enter sensitive data. - Card Cloning: Copying an access card.

Unit 3: Securing Networks - Architecture and Threat Detection

Network Attack Logic: - ARP Poisoning: Sending falsified ARP packets to associate the adversary's MAC address with a target's IP. This is an "on-path" or man-in-the-middle attack. - MAC Flooding: Overwhelming a switch with different MAC addresses to force broadcast mode for eavesdropping. - DNS Poisoning: Planting fake DNS records to redirect browsers to a malicious site (Credential Harvesting). - Smurf Attack: A DoS/DDoS attack using spoofed ICMP requests to a network's broadcast address.
Wireless Security Protocols: $WEP, WPS$ , and original $WPA$ are insecure. $WPA3$ is the current strongest algorithm.
Segmentation Techniques: - Screened Subnet (DMZ): A segment between public and private networks for publicly facing resources. - VLANs: Logical separation of devices on a switch.
Firewall Classifications: - Stateless: Filters by packet headers (IP, port, protocol). - Stateful: Tracks the state of connections for more control. - Next-Generation (NGFW): Includes deep packet inspection and application-type filtering.
Access Control Lists (ACLs): Rules checked in order. First match wins. Reversing the order changes resulting permissions.
Detection Methods: - Signature-based: Fast, compares data to a database of known Indicators of Compromise (IoCs). High speed, low false positives, but cannot detect "zero-day" (undocumented) vulnerabilities. - Anomaly-based: Compares traffic to a recorded baseline. Can detect new attacks but has higher false positive rates and requires more processing power. - Hybrid: Combines both; most expensive and effective for sensitive networks.

Unit 4: Securing Devices - Authentication and Malware Defense

Computing Device Categories: Servers, Personal Computers, Handhelds, and Embedded/IoT devices (found in medical pumps, substations, etc.).
Malware Taxonomy: - Viruses: Need user activation. - Worms: Spread without human interaction. - Trojans: Harmless-looking software containing malicious code (e.g., RATs). - Ransomware: Encrypts files for payment. - Logic Bombs: Triggered by specific conditions. - Spyware/Keyloggers: Track actions and keystrokes. - Rootkits: Operating-system level control, invisible to detection. - Fileless Malware: Lives in RAM, using legitimate programs.
Cryptographic Hashing for Passwords: - Hash function properties: Collision resistant, pre-image resistant, repeatable, fixed length. - Salting: Adding random bits to a password before hashing to prevent identical hashes for the same password. - Algorithms: $MD5, SHA\text{-}1$ (deprecated); $SHA\text{-}256, SHA\text{-}512, RIPEMD\text{-}160$ .
Password Attacks: - Password Spraying: Trying one common password against many accounts. - Credential Stuffing: Using leaked credentials or default admin logins on different services. - Brute Force: Testing all potential combinations. - Rainbow Table: Using precomputed hash tables for unsalted databases.
Factors of Authentication: - Knowledge: Something you know (PIN). - Possession: Something you have (Token). - Biometric: Something you are (Face scan). - Location: Somewhere you are (GPS/IP timezone).
Endpoint Detection and Response (EDR): Holistic service for monitoring device attacks.

Unit 5: Securing Applications and Data - Cryptography and Access Control

Data States: At rest (on drive), In transit (over cables/wireless), In use (unencrypted in memory).
Application Vulnerabilities: - SQL Injection ( $SQLi$ ): Inserting database commands into input fields to bypass logic (e.g., using ' OR '1'='1';--). - Cross-Site Scripting (XSS): Injecting malicious code executed in the victim's browser. Type I (Reflected) or Type II (Stored). - Buffer Overflow: Sending more data than a memory buffer can hold, causing crashes or unauthorized code execution. - Directory Traversal: Modifying URLs with ../ sequences to access unauthorized server files.
Access Control Models: - RBAC (Role-Based): Based on job function. - RuBAC (Rule-Based): Based on dynamic conditions like time of day. - DAC (Discretionary): Owner sets permissions. - MAC (Mandatory): External admin sets levels; includes the Bell-LaPadula model ("Write up, Read down" or WURD).
Least Privilege: Giving entities only as much access as needed to perform their function.
Linux File Permissions (ls -l): - Entities: Owner, Group, Others. - Mode: r (Read = $4$ ), w (Write = $2$ ), x (Execute = $1$ ). - Examples: chmod 750 gives owner full permissions ( $4+2+1=7$ ), group read/execute ( $4+1=5$ ), and others nothing ( $0$ ).
Cryptography Standards: - Symmetric: Single key for both (AES). AES is a block cipher handling bits in $128\text{-bit}$ chunks. - Asymmetric: Public key for encryption, private key for decryption (RSA, ECC). - Key length: $2^n$ possible keys. Encryption security depends strictly on keeping the private key secret.
Design Principles: - Secure by Design: Including security in all development phases. - Secure by Default: Security features enabled out-of-the-box.

AP Cybersecurity Exam Structure and Assessment

Section I: Multiple-Choice Questions ( $MCQs$ ): - $60$ questions, $70\%$ of score, $80$ minutes. - Weighting: Analyze Risk ( $25\text{--}40\%$ ), Mitigate Risk ( $25\text{--}40\%$ ), Detect Attacks ( $25\text{--}40\%$ ).
Section II: Free-Response Question ( $FRQ$ ): - $1$ scenario (Device Security Analysis), $30\%$ of score, $50$ minutes. - Requires analyzing security policies, firewall rules, and logs (e.g., nginx access_log, var/log/auth.log).
Task Verbs: - Identify: Provide info from sources. - Explain: Use evidence to support reasons. - Describe: Provide info about process/outcome. - Determine: Apply criteria for a result. - Write: Express a proper command (e.g., chmod or openssl).
Scoring Insight: Points are awarded for accurately identifying the IP address of an adversary (e.g., $203.0.113.25$ ) and explaining how ../ in a log indicates a directory traversal attack.