AP® Cybersecurity Key Terms

By Brian Stewart, Author of Barron’s SAT & ACT Prep Books & Perfect SAT/ACT Scorer

AP® Cybersecurity uses vocabulary the way the working field does. The terms below matter, but you earn points by applying them to a scenario: a phishing email, a firewall rule list, a set of logs, a file-permission table. You read the evidence, name the vulnerability or the sign of an attack, choose a control that fixes the specific weakness, and justify the choice. So don’t stop at defining defense in depth. Be ready to say which layer a scenario leaves unprotected and what you would add.

Treat this list as a working vocabulary rather than a flashcard deck. You need to know these terms well enough to spot them inside a scenario you have never seen and reason with them. Below are the concepts that matter most, organized around the five units the College Board uses to structure the course: Introduction to Security; Securing Spaces; Securing Networks; Securing Devices; and Securing Applications and Data. A short foundational section comes first. This is a study list built around the course framework rather than an official College Board glossary, so use it as a foundation and not the last word. For how the exam is built and how to approach the question sets and the free-response question, see the companion AP Cybersecurity practice page.

One note on how the exam counts these before you start. The multiple-choice section is weighted by skill rather than by unit. The College Board gives exam-weight ranges for three skill categories, each 25 to 40 percent: Analyze Risk, Mitigate Risk, and Detect Attacks. All five units are assessed, but no single unit carries a fixed published percentage, so the terms below are a map of what you need to know, while those three skills are how you will be asked to use it.

---

1. Foundational and Cross-Cutting Concepts

1. Cybersecurity. The practice of protecting systems, networks, devices, applications, and data from unauthorized access, damage, disruption, theft, or misuse. The course approaches it through adversarial thinking: looking at a system the way an attacker would to find what is weak.
2. Adversary. A person or group trying to compromise a system, network, device, application, or data. The exam often expects you to reason about the adversary’s skill and motivation, since both affect how likely an attack is.
3. Asset. Anything of value worth protecting, including data, money, digital infrastructure, physical property, intellectual property, and reputation. Risk always traces back to a specific asset, so naming the asset is the first step in any risk question.
4. Vulnerability. A weakness or flaw that could let an asset be compromised. A vulnerability is only a problem when a threat can actually reach and exploit it, which is why risk depends on more than the flaw alone.
5. Threat. A potential source of harm to an asset, whether a human adversary or a natural disaster. Threats and vulnerabilities are different things, and a question that asks for one is not answered by the other.
6. Risk. What exists when a threat can exploit a vulnerability to compromise an asset. The course defines risk in terms of all three, so removing any one of them, by protecting the asset, closing the vulnerability, or deterring the threat, reduces the risk.
7. Exploit. A method or piece of code that takes advantage of a vulnerability. Well-documented exploits lower the skill needed to attack, which raises the likelihood that a vulnerability will be used.
8. Confidentiality, integrity, and availability (CIA). The three security principles a control may protect: confidentiality limits access to authorized users, systems, and processes; integrity keeps data accurate and unaltered except by authorized action; availability keeps data and services accessible when authorized users need them. A control may support one of these or a combination. Naming which principle a scenario threatens is a common task on the exam.
9. Risk assessment. The process of judging a risk by two factors: the likelihood that a vulnerability will be exploited and the severity of the damage if it is. The result can be written up quantitatively or qualitatively.
10. Quantitative vs. qualitative assessment. A quantitative assessment assigns a number, such as a 1-to-10 score or a dollar figure of expected loss. A qualitative assessment uses categories like low, medium, high, or severe. Both rank risks so an organization can decide what to fix first.
11. Likelihood. How probable it is that a given vulnerability will be exploited, shaped by the value of the target, the skill the exploit requires, and the motivation and capability of likely adversaries. A highly valuable target with an easy exploit is high-likelihood.
12. Severity (impact). How much damage an attack would cause, measured in financial, operational, and reputational terms. A vulnerability that is unlikely to be exploited can still rank high if its impact would be catastrophic.
13. Risk-management strategies. The four options once a risk is assessed: avoid it (stop the risky activity), transfer it (shift the burden to another party, such as an insurer), mitigate it (apply controls to reduce likelihood or impact), or accept it. The right choice depends on cost and on how central the activity is to the organization.
14. Residual risk. The risk that remains after avoidance, transfer, and mitigation. Because absolute security is unattainable, an organization accepts the residual risk it is willing to live with.
15. Cost-effective solution. A control whose cost is reasonable compared with the expected loss it helps prevent. Strong answers favor mitigations that fit the severity of the risk rather than the most expensive option available.
16. Security control. A safeguard that protects an asset by addressing confidentiality, integrity, or availability. Controls are sorted two ways at once, by type and by function, and questions commonly ask you to place a given control in both.
17. Control types. The category a control belongs to by nature: physical (locks, fences, cameras, guards, bollards), technical (firewalls, anti-malware, encryption), or managerial (policies and procedures such as password rules and incident response plans). A policy is managerial even when it governs a physical or technical safeguard.
18. Control functions. The category a control belongs to by what it does: preventative (stops an attack, such as a lock or encryption), detective (identifies an attack, such as an intrusion detection system or a camera), or corrective (fixes the problem and restores service, such as a patch). One device can serve more than one function.
19. Defense in depth. A layered strategy that uses several types of control across human, physical, network, device, application, and data layers, so that when one control is bypassed another still limits the damage. A strong answer to a mitigation question often layers protections rather than relying on a single control.
20. Indicator of compromise (IoC). Evidence that an adversary has compromised a device or network, such as failed logins at odd hours, unexpected processes, or a file whose hash matches known malware. Detecting attacks means finding IoCs in logs and other evidence.
21. Zero day. A vulnerability that is undocumented and unknown to defenders, so no patch exists yet. Discovering zero days takes a high-skilled adversary, which is part of what separates them from low-skilled ones.

2. Unit 1: Introduction to Security

1. Social engineering. Using psychological tactics to manipulate a person into revealing information, clicking a malicious link, downloading a malicious file, or granting access. It can happen in person but more often arrives by email, text, or social media message.
2. Phishing. A social engineering attack, usually by email or message, that tricks a target into clicking a malicious link, opening a malicious file, or handing over information. AI tools can help adversaries write more polished, personalized phishing messages, reducing some of the awkward wording and grammar cues that users might otherwise notice.
3. Intimidation. A tactic that threatens negative consequences if the target does not comply, using fear to push someone into acting. It works by leveraging the natural human aversion to harm.
4. Urgency. A tactic that manufactures time pressure so the target acts before thinking it through. A message that insists you must respond immediately is using urgency to short-circuit careful judgment.
5. Online password attack. An attack in which an adversary tries to log in through an active portal using common, patterned, guessed, or stolen passwords. Its signs include many failed attempts in a short window, logins at unusual times, and logins from unknown devices.
6. Weak authentication. Authentication an adversary can defeat easily, such as short passwords, reused passwords, or passwords built from personal information. Adversaries build a dictionary of likely passwords from details like birthdays and pet names, then try them with an automated tool.
7. Password manager. A tool that stores and helps generate long, unique passwords so users do not have to reuse or memorize weak ones. It addresses the root cause of many password attacks, which is human-chosen, reused passwords.
8. Multifactor authentication (MFA). Authentication that requires two or more different factor types, such as something the user knows plus something the user has. MFA is stronger than a password alone because stealing one factor is not enough to get in, which is why it blunts many password and impersonation attacks.
9. One-time password (OTP). A temporary single-use code used as a second proof of identity. Because victims sometimes hand an OTP to an adversary during a social engineering attack, the code is only as safe as the user’s caution.
10. Adversary skill levels. Low-skilled adversaries rely on tools others built and exploit known vulnerabilities, while high-skilled adversaries can build or modify tools and discover zero days. Skill level feeds directly into how likely a complex exploit is.
11. Evil twin attack. An attack in which an adversary sets up a wireless access point with an SSID similar or identical to a legitimate network, hoping victims connect to it. Once connected, the adversary can capture traffic, though encrypted protocols like HTTPS stay unreadable.
12. Denial of service (DoS). An attack that makes a system, network, or service unavailable to authorized users. It targets the availability principle of confidentiality, integrity, and availability.
13. Jamming attack. A wireless denial-of-service attack that floods a frequency range with electromagnetic noise so legitimate devices cannot communicate. It is one wireless way to deny availability.
14. War driving. Moving around a target area to detect wireless networks and learn about them, including where a signal leaks outside the building. It is a reconnaissance technique rather than a direct attack.
15. Virtual private network (VPN). A tool that encrypts a user’s traffic between the user and the VPN provider, helping protect it on untrusted networks. The tradeoff is trust: the user must rely on the VPN provider, which may be able to see destination information and any traffic that is not otherwise encrypted.
16. AI-powered cyberattack. An attack strengthened by AI tools, including voice cloning and digital avatars that impersonate someone on a call, AI-written phishing, automated reconnaissance, and AI-assisted malware writing. Voice impersonation matters more as organizations adopt voice-based authentication.
17. Large language model (LLM). A generative AI system trained to produce and analyze language. Adversaries can craft prompts to pull sensitive information out of an LLM, or seed false information on websites so an LLM repeats it, so output should be checked against stable non-AI sources.
18. Shared secret. A word or phrase known only to two trusted people, used to verify identity in a high-stakes moment. Establishing one with close family is a defense against AI voice-cloning scams that impersonate a relative in distress.
19. AI-powered cyber defense. The use of AI tools to review security configurations, flag code vulnerabilities, suggest detection rules, and sort large volumes of system and network events into likely-malicious and harmless. Recommendations should always be checked by a knowledgeable human before being put in place.

3. Unit 2: Securing Spaces

1. Pretexting. Inventing a believable reason to contact a target, the setup that makes a social engineering request seem legitimate. A caller who claims to be from IT needing to verify your account is pretexting.
2. Authority. Impersonating someone with power over the target, or claiming to relay that person’s instructions, so the target complies without questioning. It exploits the tendency to defer to those in charge.
3. Consensus. Creating social pressure by making the target believe everyone else is already doing the requested action. The implied message is that complying is normal and expected.
4. Scarcity. Manufacturing a sense that something is limited or available only briefly, pushing the target to act before the chance disappears. It pairs naturally with urgency.
5. Familiarity. Pretending to be or to know someone close to the target in order to build trust. A request feels safer when it seems to come from a friend or colleague.
6. Script kiddie. A low-skilled adversary who runs tools built by others without understanding how they work, often motivated by greed or a desire for recognition. They depend on known, well-documented exploits.
7. Hacktivist. An adversary motivated by a social, political, or personal cause who uses unauthorized cyber activity to publicize a cause, disrupt an organization, or pressure a target. A hacktivist may attack a high-value target for attention rather than money.
8. Insider adversary. A threat from someone with legitimate credentials and access, which makes them uniquely dangerous. Insiders can be recruited by outside parties and are often driven by greed or revenge.
9. Cyberterrorist. An adversary motivated by ideological or political goals who aims to create fear, disruption, or harm by targeting public services, critical infrastructure, or large communities. They may act alone or for a government or criminal organization.
10. Transnational criminal organization. A cross-border criminal group seeking financial gain, mainly through ransomware and the theft of corporate intellectual property to sell. Their scale and resources make them a serious, well-funded threat.
11. Phases of a cyberattack. The sequence adversaries may work through, not all used every time: reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection. Knowing the phase a scenario describes helps you predict the adversary’s next move.
12. Open source intelligence (OSINT). Freely available information, such as social media posts and public websites, gathered during reconnaissance. AI tools can scan the internet to assemble OSINT on a target quickly.
13. Command and control (C2). A channel an adversary uses to send commands to a compromised device and receive output, often through malware like a remote access trojan or rootkit. C2 lets the adversary remotely control or coordinate compromised systems after gaining access.
14. Privilege escalation. Gaining higher-level permissions than the adversary started with, typically during lateral movement, to reach more sensitive systems and data. Accounts with elevated permissions are the main objective.
15. Exfiltration. The unauthorized transfer of data out of a system or network, the result an adversary pursues in the taking-action phase. Detecting unusual outbound transfers is one way to catch it.
16. Piggybacking and tailgating. Two ways an adversary slips into a restricted area behind an authorized person. In piggybacking the authorized person is manipulated into granting access, such as holding a door for someone carrying boxes. In tailgating the adversary follows close behind without that person’s knowledge.
17. Shoulder surfing, dumpster diving, and card cloning. Three low-tech physical attacks. Shoulder surfing watches a user enter sensitive information; dumpster diving searches physical trash for useful information; card cloning copies an authorized access card to gain the same entry. Each turns a physical lapse into a foothold.
18. Security awareness training. A managerial control that teaches employees to recognize phishing, refuse to badge strangers into restricted areas, and prevent device theft. People are often the first to notice an unauthorized person, which makes training a real defense.
19. Workstation security policy. A managerial control setting rules for protecting a physical workspace, often including locking devices when unattended, clearing sensitive documents (a clean desk policy), using a privacy screen filter, and connecting equipment to an uninterruptible power supply (UPS). Tiers may vary by how sensitive the data handled there is.
20. Physical preventative controls. Barriers that stop or deter physical access: fences, gates, and bollards around a building; locks on doors, server cabinets, and computers; card readers that log and restrict entry; and access control vestibules or turnstiles that stop one authorized person from admitting an unauthorized one.
21. Physical detective controls. Controls that catch a physical breach: cameras (best recorded and monitored, and strongest at points of entry and exit), motion sensors (best in low-traffic areas like server rooms to avoid false alarms), and security guards (stationary at choke points, patrolling for perimeters). Door sensors can flag a door held open longer than normal, a sign of tailgating.

4. Unit 3: Securing Networks

1. LAN (local area network). A network covering a limited area such as a home, office, or building. Once an adversary compromises one device on a LAN, they often try to reach others on it.
2. MAC address. A hardware address identifying a device’s network interface. Faking one is called MAC spoofing, and it lets an adversary impersonate a legitimate device on the network.
3. ARP poisoning. Sending falsified Address Resolution Protocol messages so a device associates another device’s IP address with the adversary’s MAC address, setting up an on-path attack. It redirects traffic meant for the target to the adversary instead.
4. On-path attack (man-in-the-middle). An attack in which an adversary secretly sits between two parties, capturing and possibly altering their messages while each believes it is talking directly to the other. ARP poisoning is one way to get into that position.
5. MAC flooding. Overwhelming a switch with frames carrying many different MAC addresses, which can cause it to send some traffic more broadly than intended. This can let an adversary capture traffic that would normally go only to its destination. It is a form of eavesdropping, and port security is the defense.
6. Eavesdropping (sniffing). Capturing data in transit on a network so it can be recorded and copied. It is a confidentiality attack, and encryption is what keeps captured traffic unreadable.
7. DNS poisoning. Planting a false Domain Name System record so users are redirected to a malicious site, often a fake login page. It is hard to detect, but an abrupt, unexplained drop in a site’s traffic can be a clue.
8. Credential harvesting. Setting up a fake login page that looks real so unsuspecting users enter credentials the adversary captures. DNS poisoning and evil-twin captive portals are common ways to steer victims to it.
9. Smurf attack. A denial-of-service attack that sends ICMP requests with the victim’s address to a network’s broadcast address, so every device replies to the victim and floods it. A spike in ICMP traffic involving a broadcast address, or many replies to one host, can be a sign.
10. Distributed denial of service (DDoS). A denial-of-service attack carried out by many devices at once against one target. The distribution makes it harder to block than a single-source flood.
11. Rogue access point. An unauthorized wireless access point an adversary plugs into an open network port, opening a wireless path into the internal network that bypasses the firewall. It can give direct LAN access, sometimes from outside the building.
12. Port security. A switch feature that limits how many or which MAC addresses can use a port, preventing MAC flooding and blocking adversaries who physically plug into a data port. It is a basic switch hardening step.
13. Beacon frame. A wireless announcement that broadcasts a network’s SSID and basic properties. Disabling beacon broadcasting makes a network less obvious to casual discovery, though it is not a substitute for strong authentication and encryption.
14. Wireless security standards and methods. Security options used to control or protect wireless access. WEP, WPS, and the original WPA have known vulnerabilities and are insecure; in the CED, WPA3 is identified as the strongest listed wireless security option. Strong wireless encryption keeps intercepted frames unreadable.
15. Network segmentation. Dividing a network into smaller, isolated subnetworks so an attack on one segment cannot easily reach the others. Segmentation also lets an organization apply different security levels to different zones.
16. Screened subnet (DMZ). A network segment between the public internet and the private internal network, usually holding public-facing resources like web servers. It sits at a lower security level than the internal network, with a stricter firewall guarding the LAN behind it.
17. VLAN. A virtual local area network created with switches to logically separate devices that are physically connected to the same switches. It is one technique for segmenting a network without rewiring it.
18. Firewall. A hardware or software security control, on a router, dedicated appliance, cloud service, or host, that allows or denies traffic according to rules. Firewalls belong at trust boundaries, such as between the internet and an internal network or between network segments.
19. Stateless vs. stateful firewall. A stateless firewall filters on packet-header details like IP address, port, and protocol. A stateful firewall also tracks the state of connections, allowing finer control over what passes. A next-generation firewall (NGFW) adds advanced features such as intrusion prevention and deep packet inspection.
20. Access control list (ACL). The ordered set of rules a firewall uses to permit or deny traffic, each rule naming a direction, a criterion such as IP address or port, and an action. Rules are checked in order and the first match wins, so reordering them can change what gets through. This first-match behavior is a common source of mistakes.
21. NIDS, NIPS, and SIEM. Automated detection tools. A network intrusion detection system (NIDS) analyzes traffic and raises an alert; a network intrusion prevention system (NIPS) can also block or stop the attack; a security information and event management (SIEM) system pulls data from many sources to spot patterns and alert analysts, who investigate and escalate.
22. Signature- vs. anomaly-based detection. Signature-based detection compares activity to a database of known indicators and is fast, efficient on high-traffic networks, and low on false positives, but it cannot catch a brand-new attack. Anomaly-based detection compares activity to a baseline of normal behavior, can catch novel attacks, but costs more and raises more false positives. Hybrid detection combines both at higher cost.
23. False positives, false negatives, and alert fatigue. A false positive flags harmless activity as an attack; a false negative misses a real one. Setting a detection threshold too low buries the team in false positives, and too high lets real attacks through. When responders see too many false positives, alert fatigue sets in and they start dismissing alerts before investigating.

5. Unit 4: Securing Devices

1. Computing device types. The course groups devices as servers (which provide services to other computers), personal computers, handheld or mobile computers, and embedded computers (built into a machine). Each carries different resources and risks, which affects what detection tools they can run.
2. Internet of Things (IoT). Everyday objects with embedded computers and network connections, from thermostats to medical pumps to industrial controls. They often have limited computing power and weak default security, which makes them attractive targets.
3. Malware. Malicious software that damages or destroys a device or network, or gives an adversary access to it. It is usually a tool toward a larger goal rather than the goal itself, and the type matters because each behaves differently.
4. Virus. Malware that must be activated by a user opening or running a file. Its dependence on human action distinguishes it from a worm.
5. Worm. Malware that spreads from computer to computer on its own, without any user interaction. Self-propagation is what makes worms spread fast.
6. Trojan and RAT. A trojan is malware hidden inside software that looks harmless. A remote access trojan (RAT) is a trojan that hands the adversary remote control of the system, often as the channel for command and control.
7. Ransomware. Malware that encrypts a device’s files and demands payment for the decryption key, usually within a deadline. It is an availability attack that can shut an organization down.
8. Spyware. Malware that tracks a user’s actions and reports them back to an adversary. A keylogger is a related tool, in software or hardware, that records keystrokes to capture usernames and passwords.
9. Rootkit. Sophisticated malware that buries itself in the operating system and can control nearly every part of it, including hiding itself from detection. Its stealth makes it especially hard to remove.
10. Logic bomb. Malware set to trigger only when specific conditions are met, such as a date or a software version. Until the trigger fires, it sits dormant and unnoticed.
11. Fileless malware. Malicious code that lives in RAM and abuses legitimate programs already on a device rather than relying on a file. Because there is no file to scan, signature-based tools struggle to catch it.
12. Patch. An update, often small, that fixes a known vulnerability in an operating system or software. Devices running unpatched software are open to exploits that a current version would have closed.
13. BIOS / UEFI. The low-level firmware that starts and configures a computer. Without a firmware password, an adversary with physical access may be able to change startup settings or boot from external media, potentially bypassing operating-system controls if other protections are absent.
14. Cryptographic hash function. A one-way algorithm that turns input of any length into a fixed-length output called a hash, checksum, or digest. A secure cryptographic hash function is designed to be repeatable (same input, same output), collision resistant, and pre-image resistant (you cannot work backward from the hash to the input), which is why hashing is used to store passwords and verify file integrity.
15. Collision. When two different inputs produce the same hash. If an efficient way to force collisions is found, the hash function is deprecated, which is why MD5 and SHA-1 are deprecated for security-critical uses.
16. Salt. Random bits hashed together with a password so that two users with the same password still get different stored hashes. Salting defeats precomputed attacks that rely on identical passwords producing identical hashes.
17. Online vs. offline password attack. An online attack tries username and password combinations against a live login portal and can be slowed by account lockout. An offline attack runs against a stolen password database on the adversary’s own machine, bypassing lockout entirely. A stolen hash database is treated as a serious compromise because offline cracking bypasses login lockout and may allow weak passwords to be recovered.
18. Password spraying. Trying one common password against many different accounts, the reverse of hammering one account with many guesses. The log signature is many users seeing a login attempt within seconds from one IP address.
19. Credential stuffing. Trying stolen, leaked, or default credentials against accounts and devices, exploiting password reuse and unchanged factory passwords on routers and IoT gear. A burst of default username-and-password combinations from one IP address is a common sign.
20. Offline brute force vs. dictionary attack. Both are offline attacks that hash candidate passwords and compare them to a captured hash. A brute force attack tries every possible password; a dictionary attack tries a list of common ones, trading completeness for speed.
21. Rainbow table. A precomputed table of passwords and their hashes, sorted by hash, that lets an adversary match a captured hash to its password quickly. Salting is what makes rainbow tables ineffective.
22. Authentication factors. The kinds of proof a user can present: something they know (knowledge, such as a password or PIN), something they have (possession, such as a token or phone), something they are (biometric, such as a fingerprint or face), and somewhere they are (location, from GPS or IP data). Combining two or more different factor types is what makes MFA strong.
23. Login settings. Configurable rules that harden authentication: password complexity (mixing character sets), minimum length, maximum age, password history (to block reuse), and account lockout after a set number of failed attempts. Some standards now discourage routine forced password changes unless compromise is suspected, because users often respond by creating predictable patterns. Lockout stops online guessing but does nothing against an offline attack.
24. Anti-malware software. Software that scans files against a database of malware signatures, then quarantines and removes matches. It is a technical control, and devices without it are more exposed to malware.
25. Host-based firewall. A firewall that runs on a single device and allows or denies that device’s traffic by an ACL, just like a network firewall. It adds a layer in case the host connects to a compromised network, and should block ports and services the device does not need.
26. Device security policies. Managerial controls that set rules for safe device use, such as acceptable use policies (what users may and may not do on a device), password policies, and software installation policies (what software may be installed and how to request it). They are managerial controls even when they govern technical settings.
27. Endpoint detection and response (EDR). A device-level security tool or managed service that monitors endpoints for suspicious activity and provides centralized alerts, investigation tools, and response options. It is useful related vocabulary for device detection, though the CED emphasizes logs, IoCs, anti-malware, host-based firewalls, and authentication-log analysis more directly.
28. Host, file, behavior, and network-based IoCs. The places device- and network-level evidence shows up. Host-based IoCs appear in logs and configuration settings; file-based IoCs appear in files, such as a hash matching known malware; behavior-based IoCs appear as suspicious actions, such as repeated failed logins or attempts to elevate privileges; network-based IoCs appear in traffic, such as unusual IP addresses, ports, protocols, traffic volume, or communication patterns. Authentication logs are a primary source.

6. Unit 5: Securing Applications and Data

1. Application and web application. An application is a program that runs instructions on a computer. A web application runs on a server and is reached over a network through a browser, which widens the attack surface to anyone who can send it a request.
2. Standard vs. administrative user. A standard user has limited permissions; an administrative user can change system settings and reach most files and applications. Giving regular users admin rights is risky, because an adversary who compromises that account inherits the elevated access.
3. Data validation and input sanitization. Data validation checks that user input matches what is expected before processing it, such as requiring a number where a number belongs. Input sanitization removes or rejects dangerous characters, especially control characters like quotes and semicolons. Together they defend against injection-type attacks.
4. Injection attack. An attack that inserts unexpected commands or characters into an input field to change how a program behaves. Applications that fail to validate or sanitize input are the ones at risk.
5. SQL injection. An injection attack that places SQL commands into an input field to read, modify, or delete database data, breaching confidentiality or integrity. Logs showing input with SQL control words like WHERE or patterns like OR 1=1 are indicators.
6. Cross-site scripting (XSS). An attack that injects malicious code into a website so a visitor’s browser runs it. Reflected (Type I) XSS rides in a link the user clicks; stored (Type II) XSS is saved on the site, such as in a comment, and can affect users who view that stored content. A <script> tag in user input is a red flag.
7. Buffer overflow. An attack that sends more data than a buffer, a fixed-size block of memory, can hold, so the excess overruns adjacent memory and can crash the system or run unauthorized code. Unusually long input in a URL or request field is the warning sign.
8. Directory traversal. An attack that modifies a URL or GET request with sequences like ../ to climb out of the intended folder and reach sensitive files on the server. Server logs showing ../ in requested paths point to it.
9. Data states. Data exists in three states, each protected differently: at rest (stored on a drive, protected by encryption and physical security), in transit (moving between devices, protected by encryption), and in use (being processed, when it often must be available in usable form, so access controls are especially important).
10. PII. Personally identifiable information, any data that identifies a person, such as name, address, biometric data, Social Security number, date of birth, or email address. The handling of PII is often regulated by privacy laws and organizational policies, which vary by jurisdiction.
11. PHI. Protected health information, any data about a person’s health, treatment, or healthcare payment, such as test results and visit notes. In the U.S., PHI is regulated by HIPAA.
12. PCI. Payment card information, the data used to process card payments, including account number, expiration date, and CVV. Payment-card data security is governed by PCI DSS (the Payment Card Industry Data Security Standard).
13. Data classification. Sorting data by sensitivity so that more sensitive information gets a higher degree of protection. Regulated categories like private, healthcare, and financial data often carry legal storage and monitoring requirements.
14. Access control. A system that enforces which subjects (users or applications) can perform which operations (read, modify, add, remove) on which objects (files or applications). Access control models describe how those decisions are made.
15. Role-based access control (RBAC). A model that assigns each subject to a role and grants access by role, so an “accountant” role gets access to payroll software. It scales well because access follows the role rather than the individual.
16. Rule-based access control (RuBAC). A model that allows or denies access by checking rules, such as blocking a database outside working hours even for users who normally have access. It is usually layered on top of another model.
17. Discretionary access control (DAC). A model in which the owner of an object decides who else may access it, while administrators can override those choices. The owner’s discretion is what names the model.
18. Mandatory access control (MAC). A model with strict, administrator-assigned levels for subjects and objects, common in government and military settings. The Bell-LaPadula model is a MAC model commonly remembered as “no read up, no write down”: subjects cannot read objects above their level or write to objects below it.
19. Principle of least privilege. Giving an entity exactly the access it needs to do its job and no more. It limits the damage when an account is compromised, since the attacker inherits only that minimal access.
20. Linux permissions. File permissions are set as read, write, and execute (rwx) for three groups in order: owner, group, and others. The numeric method uses read as 4, write as 2, and execute as 1, so 750 gives the owner full access, the group read and execute, and others no access. The chmod command sets them. Reading Linux permissions may appear in the Device Security Analysis free-response question, which can include file-system permissions along with policies, firewall configurations, and logs.
21. Encryption and decryption. Encryption combines plaintext with a key to produce unreadable ciphertext; decryption reverses it. A cryptographic algorithm defines the process, and the goal is to keep information hidden from anyone without the key.
22. Key and keyspace. A key is the value an algorithm uses to encrypt or decrypt. The keyspace is the number of possible keys, equal to 2 raised to the key length in bits, so a longer key is harder to guess. Key lengths only compare within the same algorithm, so an AES 256-bit key beats an AES 128-bit key, but AES and RSA keys cannot be compared directly.
23. Symmetric vs. asymmetric encryption. Symmetric encryption uses one shared key to encrypt and decrypt; AES is the common standard. Asymmetric encryption uses a mathematically related public/private key pair: for a confidential message, data are encrypted with the recipient’s public key and decrypted with the recipient’s private key, letting people communicate securely without sharing a secret in advance. RSA and ECC are common asymmetric algorithms, and related key-pair methods are also used in digital signatures and certificates.
24. Public and private keys. The two halves of an asymmetric key pair. The public key is published for anyone to use; the private key is kept secret. To send securely, you encrypt with the recipient’s public key so only their private key can decrypt it, which is why a leaked private key forces the whole pair to be replaced.
25. Secure by design and secure by default. Secure by design builds security into every phase of product development rather than bolting it on later. In the AP framework, it also includes organizational responsibility for customer security outcomes, transparency, and leadership support. Secure by default means a product’s security features are turned on out of the box, so users are protected without extra setup.
26. Honeypot. In this course, a file that looks valuable but holds fake data, set up so any attempt to access it raises an alert. Because there is no legitimate reason to open it, access is a strong indicator of malicious activity, and detection is nearly instant.
27. Data loss prevention (DLP). A tool or service that monitors how data is accessed, used, and transmitted across an organization to catch suspicious activity or prevent unauthorized data exposure. It offers strong detection at a higher cost than simple controls like honeypots or hash checks.
28. Accounting. Recording and monitoring user activity after authentication and authorization, so an organization can investigate what authenticated users actually did. It is the detection counterpart to access control, turning permitted actions into a reviewable record.
29. Hash verification. Hashing a file, recording the digest, and hashing it again later to compare. Because a hash function is repeatable, a changed digest means the file was altered, though hashing cannot detect data that was merely viewed or copied without change.

AP® is a registered trademark of the College Board, which was not involved in the production of, and does not endorse, this content. This is a study list aligned to the AP Cybersecurity course framework, not an official College Board glossary.