Cambridge IGCSE IGCSE & A-Level Sheet preview

Learn Extracted exam questions AP Cybersecurity Official Sample Questions

Official Sample Questions

Source PDF on the left, extracted YAML on the right. Compare numbering, marks, options and text.

1 1 mark multiple_choice 3.1

A cybersecurity analyst recently completed a review of a hotel's security. Consider the following information from their report. (1) The hotel's Wi-Fi extends to the parking area, allowing outsiders potential access to the network. (2) Open network ports in the conference center connect to the hotel's internal network and could enable spoofing of a legitimate device. (3) Guest feedback tablets in the lobby use a shared Wi-Fi network, exposing nonsensitive customer satisfaction data. (4) Model numbers of printers and the firmware versions the printers are running are visible on the internal network, revealing some information about devices on the network. Which of the following risks would the cybersecurity analyst most likely document as a high risk?

  1. A

    The hotel's Wi-Fi extending to the parking area
  2. B

    Open network ports in the conference center
  3. C

    Guest feedback tablets using a shared Wi-Fi network
  4. D

    The model numbers of printers and the firmware versions the printers are running being visible
2 1 mark multiple_choice 5.2

A school district wants to ensure that only the school principal (kmurray) can edit faculty evaluation reports and to limit permissions for everyone else. The district's system administrator wants to set the following permission for the file Oak_Park_HS, which contains the faculty evaluations: -rw-r----- kmurray staff 2048 Sep 18 10:45 Oak_Park_HS. Which of the following commands can be used to set the permissions shown?

  1. A

    chmod 444 Oak_Park_HS
  2. B

    chmod 640 Oak_Park_HS
  3. C

    chmod 740 Oak_Park_HS
  4. D

    chmod 777 Oak_Park_HS
3 1 mark multiple_choice 5.2

Consider the following email. From: Management, To: Security Manager, Subject: New Access Rules for Transaction System. "Thank you for implementing access restrictions on our internal applications. We are now interested in applying additional security rules that automatically limit user access based on specific conditions. For example, access to the transaction system should only be allowed during business hours and from devices connected to the corporate network." Which of the following access control models best meets the request in the email?

  1. A

    DAC
  2. B

    MAC
  3. C

    RBAC
  4. D

    RuBAC
4 1 mark multiple_choice 3.4

A network technician is unable to access a server using port 443 from a machine with an IP address of 192.168.45.37. Consider the server's firewall access control list (ACL): rules 1-2 allow inbound TCP 22 and 80 from ALL; rule 3 denies inbound TCP 443 from 192.168.0.0-192.168.255.255; rule 7 allows inbound TCP 443 from ALL; rule 10 denies ALL. ACL rules are checked in order and the first match wins. Which of the following changes to the firewall would allow the network technician to access the server?

  1. A

    Swap firewall rule 1 with firewall rule 10
  2. B

    Swap firewall rule 3 with firewall rule 4
  3. C

    Swap firewall rule 3 with firewall rule 7
  4. D

    Swap firewall rule 4 with firewall rule 7
5 1 mark multiple_choice 4.2

A system administrator runs two hashing functions on four files. In Function 2's outputs, file1.txt and file3.txt produce the identical hash 804537a7adfa4e1bce4d72d0b212a80af2dae3a5e, while their Function 1 outputs differ. Which of the following statements is supported by the file hashes?

  1. A

    The files file1.txt and file3.txt are exact copies of each other.
  2. B

    Function 1 is more secure than Function 2.
  3. C

    Function 1 and Function 2 are the same hashing function.
  4. D

    The files file1.txt and file3.txt have a collision in one hashing function.
6 1 mark multiple_choice 4.2

The security manager at a hospital is planning to upgrade the physical security system so that only authorized personnel can access areas containing sensitive medical equipment and patient records. Because these areas require a high level of security, the manager wants an authentication method that is unique to each individual and extremely difficult for an adversary to duplicate or spoof. Which of the following authentication methods is best suited for these areas?

  1. A

    Authentication token
  2. B

    Password
  3. C

    Retina scan
  4. D

    Access card
7 1 mark multiple_choice 4.2

Which of the following best describes how offline password attacks work?

  1. A

    Adversaries attempt user:password combinations in an active authentication portal.
  2. B

    Adversaries intercept communication as it travels across a network and read the password in transit.
  3. C

    Adversaries exploit weak access controls to directly retrieve plaintext passwords stored in a database.
  4. D

    Adversaries use automated tools to hash many potential passwords and compare them to a captured hash.
8 1 mark multiple_choice 1.1

Refer to the phishing email (subject "Final Reminder — Deadline Today!") reported to security. It states records are incomplete, that staff must confirm personal information by the end of the day, and that failure to respond may result in suspension of payroll access. Which of the following shows how the email uses urgency to pressure the recipient into responding?

  1. A

    The recipient is warned that they must confirm their personal information by the end of the day.
  2. B

    The recipient is warned that failure to comply could result in payroll suspension.
  3. C

    The recipient is encouraged to help human resources keep their records accurate.
  4. D

    The recipient is told that the message comes from a trusted internal department.
9 1 mark multiple_choice 2.1

Referring to the same phishing email, how does the claim that "Over 92% of employees have already completed the verification" attempt to pressure the recipient into responding?

  1. A

    By framing the request as routine HR communication that seems safe, showing the use of familiarity
  2. B

    By implying that the opportunity to comply is limited and may soon be lost, showing the use of scarcity
  3. C

    By presenting the request as coming from those in power and intimidating the recipient, showing the use of authority
  4. D

    By applying social pressure and making the recipient believe most coworkers have already acted, showing the use of consensus
10 1 mark multiple_choice 1.1

Referring to the same phishing email, which of the following is the most likely impact if the recipient responds with the requested information (personal phone number, pet's name, and date of birth)?

  1. A

    An adversary could use the recipient's personal details to impersonate them.
  2. B

    An adversary could use the recipient's device as a foothold and move laterally on the network compromising other devices.
  3. C

    An adversary could infect the recipient's device with malicious code hidden in the reply email.
  4. D

    An adversary could disrupt the entire payroll system by disabling access for all employees.
11 1 mark multiple_choice 5.6

A natural gas company's help desk receives reports that the website is intermittently crashing when employees try to log in. The server's access logs include: GET /index.html 200; GET /about.html 200; GET ../../../../etc/passwd 403; GET ../../../../etc/shadow 403. Which of the following application attacks is indicated in the log file?

  1. A

    Buffer overflow attack
  2. B

    Cross site scripting attack
  3. C

    Directory traversal attack
  4. D

    SQL injection attack
12 1 mark multiple_choice 4.4

The system administrator at a high school receives an alert that there may have been multiple unauthorized login attempts to the school's online grading system. To investigate, the administrator decides to review the authentication logs. Which of the following best describes how authentication logs can be used to determine whether unauthorized login attempts have occurred?

  1. A

    The logs record which password was used in each login attempt, which allows the administrator to verify account ownership.
  2. B

    The logs record all login activity, which allows the administrator to reconstruct when and how login attempts occurred.
  3. C

    The logs record the location of each user attempting to log in, which allows the administrator to identify login attempts from other geographic regions.
  4. D

    The logs record the type of device attempting to log in, which allows the administrator to block unauthorized devices.
13 1 mark multiple_choice 3.5

The network administrator for a manufacturing facility has implemented a signature-based network detection system. Which of the following is a potential impact of using this network detection method instead of anomaly-based detection?

  1. A

    More false negative alerts
  2. B

    Higher operating costs
  3. C

    Slower detection time
  4. D

    More alert fatigue
14 1 mark multiple_choice 3.5

Consider the following lines from a log file: 2025-09-25 08:01:14 ARP Reply: 192.168.1.13 is-at 00:01:5e:00:fc:16; 2025-09-25 09:14:15 ARP Reply: 192.168.1.13 is-at 00:3b:cc:5e:ee:01. Which of the following attack types is indicated in the log file?

  1. A

    ARP poisoning attack
  2. B

    DNS poisoning attack
  3. C

    Evil-twin attack
  4. D

    MAC flooding attack
15 1 mark multiple_choice 4.2

Which of the following best describes the length of a cryptographic hash function output?

  1. A

    The length of the output is longer than the input due to the hashing process.
  2. B

    The length of the output is fixed regardless of the length of the input.
  3. C

    The length of the output varies based on the length of the input.
  4. D

    The length of the output is shorter than the length of the input.
16 1 mark multiple_choice 2.2

A state's National Guard base is documenting cybersecurity risks from physical vulnerabilities. Which of the following would be classified as a moderate risk?

  1. A

    An unlocked trailer containing non-networked office equipment that cannot be used to access sensitive systems
  2. B

    A locked warehouse with noncritical computers that could be a foothold to access other network resources
  3. C

    A publicly accessible touchscreen directory for visitors that contains no sensitive data and is unlikely to be exploited
  4. D

    A main server room that contains sensitive systems and information and does not have sufficiently restricted or controlled access
17 1 mark multiple_choice 2.1

Refer to the news article about Fairgrove Community Bank, which stopped a cyber intrusion of its customer database. A network administrator said one submitted string included ' OR '1'='1';-- and added, "This wasn't some advanced adversary. They were copying code from the internet and testing to see if anything would work." Which of the following best describes the adversary in this scenario?

  1. A

    Cyberterrorist
  2. B

    Script kiddie
  3. C

    State actor
  4. D

    Insider
18 1 mark multiple_choice 5.6

Referring to the same news article, which of the following types of attacks occurred when the adversary submitted a string that included ' OR '1'='1';--?

  1. A

    SQL injection attack
  2. B

    Buffer overflow attack
  3. C

    Cross site scripting attack
  4. D

    Directory traversal attack
19 1 mark multiple_choice 5.5

Referring to the same news article, which of the following security controls would most likely prevent an attack like this in the future?

  1. A

    Encryption
  2. B

    Stateful firewall
  3. C

    Input sanitization
  4. D

    Access control list
20 1 mark multiple_choice 5.1

Referring to the same news article, which of the following best explains how the adversary attempted to manipulate the bank's customer database through the online loan application form?

  1. A

    When user input is fed into a server's file system, HTTP requests can access sensitive data.
  2. B

    When user input contains executable scripts, those scripts can run in the user's browser and access sensitive data.
  3. C

    When user input exceeds the size of the designated memory, it can allow the adversary to access, modify, and delete files.
  4. D

    When user input from a web form is fed directly into a database query, an adversary can inject control characters that can allow an adversary to view or modify the contents of a database.
21 1 mark multiple_choice 4.2

An organization only allows their users to log into a system if they are physically in one of the following time zones: Eastern, Central, Mountain, or Pacific. Which of the following authentication factors is being used to verify the identity of the users?

  1. A

    Biometric factor
  2. B

    Knowledge factor
  3. C

    Location factor
  4. D

    Possession factor
22 1 mark multiple_choice 3.5

A hospital's security manager has implemented an automated network security tool that: analyzes network traffic for signs of malicious activity so the team can spot threats; generates an alert when suspicious or malicious traffic is detected; but does not take direct action to block or stop the traffic itself, because the hospital wants administrators to decide how to respond. Which of the following security systems did the security manager implement?

  1. A

    Data loss prevention system
  2. B

    Network intrusion prevention system
  3. C

    Network intrusion detection system
  4. D

    Security information and event management system
23 short_answer

Device Security Analysis (14 points). The sources (a device firewall ACL, three system/auth logs, an nginx access log, a file-permission listing, and an acceptable use policy) all come from one device (IP 192.168.1.10). Use them to answer parts A-E. Part A: (i) explain how one part of the AUP protects the device; (ii) explain how one rule could be modified to make it more secure, with an example. Part B: (i) describe the log evidence of a password attack in rows 3-12; (ii) identify the adversary's IP address. Part C: (i) explain how one file's permissions in /home/jprice/Documents set access for owner/group/others; (ii) describe how to reconfigure one file's permissions to restrict some users; (iii) write the chmod command(s). Part D: (i) explain how one connection attempt was blocked by the firewall, with log evidence; (ii) describe a firewall-rule modification that would allow it; (iii) describe one impact of that modification on network traffic. Part E: (i) determine another attack type evidenced in a log; (ii) describe the specific log evidence; (iii) describe how an automated system could halt it in real time; (iv) identify a different (non-automated) countermeasure.

23ai 1 mark short_answer 5.54.3

Explain how one part of the policy in Source 6 helps protect the device.

23aii 1 mark short_answer 4.3

Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example.

23bi 1 mark short_answer 4.4

Describe the evidence in the log file that indicates a password attack (rows 3-12). Include specific entries.

23bii 1 mark short_answer 4.4

Identify the IP address of the adversary.

23ci 1 mark short_answer 5.2

Explain how the permission settings for one file in /home/jprice/Documents determine the level of access for the owner, group, and all other users. Include the file name.

23cii 1 mark short_answer 5.2

Other than removing all permissions from all users, describe one way one file's permissions could be configured to restrict access for some users. Include the file name.

23ciii 1 mark short_answer 5.2

Using the explanation from part C(ii), write one or more chmod commands that set the permissions described.

23di 1 mark short_answer 3.44.4

Explain how one connection attempt on the device was blocked by the firewall. Include evidence from a log file.

23dii 1 mark short_answer 3.4

Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt from part D(i).

23diii 1 mark short_answer 3.4

Other than allowing the connection attempt from part D(i), describe one impact of your modification from part D(ii) on incoming or outgoing network traffic.

23ei 1 mark short_answer 3.55.64.1

Apart from the password attack in part B, determine the type of another attack evidenced in a log file.

23eii 1 mark short_answer 5.6

Describe specific information in the log file that indicates the attack named in part E(i).

23eiii 1 mark short_answer 3.5

Describe one way an automated system could halt this type of attack in real time.

23eiv 1 mark short_answer 5.5

Identify a different countermeasure (other than an automated firewall/IDS/IPS/AI) that could mitigate, prevent, or deter the attack.

Log in or create account

IGCSE & A-Level