AP® Cybersecurity Practice Drills & Strategy Guide

By Brian Stewart, Author of Barron’s SAT & ACT Prep Books & Perfect SAT/ACT Scorer

AP® Cybersecurity is an applied course. The exam asks you to analyze real scenarios and digital evidence, not recite definitions in isolation. It may give you a situation such as a phishing email, a firewall rule list, a set of logs, a physical-security scenario, or a file-permission table, and ask you to read it accurately, spot the vulnerability or the sign of an attack, choose a control that addresses the weakness, and justify the decision. Knowing the vocabulary matters, but most questions reward what you can do with it in a realistic security situation.

That is why memorizing terms is not enough. You’ll be better prepared if you can read a scenario closely, reason about how an attacker would exploit a weakness, and match a defense to the specific problem in front of you, rather than relying on raw recall. Vocabulary is still the foundation, though, and if you want to review the concepts first, start with the AP® Cybersecurity key terms organized by unit. Below, you’ll find how the exam is structured, what its three exam-weighted skills test, the mistakes that catch prepared students, and how to use these drills to build the habits that transfer to test day.

How the AP® Cybersecurity Exam Works

This is a fully digital exam administered in the Bluebook app, with responses submitted automatically at the end. It has two sections. The multiple-choice section carries the most weight (70%), and because many of its questions come in scenario-based sets, practicing careful evidence reading is one of the most efficient uses of prep time. The first national AP Cybersecurity Exam administration is scheduled for May 2027.

The single free-response question is a Device Security Analysis. You are given several sources of information about the same device: a set of firewall rules, system and application logs, a list of files with their permissions, and a device policy. You then work across all of them to explain parts of the policy, find signs of attacks in the logs, configure file permissions and firewall rules, and use the evidence to recommend ways to harden the device. The multiple-choice section trains the same reading-evidence-and-recommending reasoning this question demands. Two of the drills below (29 and 30) are built as cross-source, FRQ-informed practice for it.

The Three Exam-Weighted Skills

The published multiple-choice weighting is organized by skill rather than by unit. College Board gives exam weight ranges for three skill categories: Analyze Risk, Mitigate Risk, and Detect Attacks, each in the range of 25–40%. The course also includes a fourth skill category, Collaborate, which is developed through coursework and classroom activities rather than listed in that weighting table. Knowing which skill a question is testing helps because each one calls for a different move: spotting a weakness, choosing a control, or reading evidence for signs of an attack.

Analyze Risk asks you to identify vulnerabilities and threats and reason about how likely and how damaging they are, including how an adversary would exploit a weakness. Mitigate Risk asks you to choose and configure security controls, assess whether they work, and plan layered defenses. Detect Attacks asks you to read logs, alerts, and network data for indicators of compromise and recognize attack patterns. All three are threaded through the course’s units, which is why the drills below mix them rather than isolating them.

The Five Units

The course content is organized into five units that move outward from foundational ideas to specific environments you have to defend: yourself and your information, physical spaces, networks, devices, and finally applications and data. All five units are in scope for the multiple-choice section, but the published weighting is given by skill rather than as a fixed percentage for each unit, so treat the units below as a map of what you need to know and the three exam-weighted skills above as how you will be asked to use it.

What the Multiple-Choice Section Tests

Many multiple-choice questions come in sets of two, three, or four that share a single piece of source material: a scenario describing a system or facility, a log excerpt, a configuration table, a firewall rule list, or a diagram. Because several questions can draw on the same source, a careful first read pays off across all of them. Read it closely the first time, pin down what kind of system this is and what the source is telling you, and you will save time on every question in the set.

Within a set, questions often move among several tasks: reading the source, identifying a concept or attack, evaluating a control, explaining why an adversary or defender would act a certain way, or choosing the best mitigation. Do not assume every set follows the same order; use the question stem to identify the task in front of you instead of expecting a fixed sequence.

How to Read an AP® Cybersecurity Question

Whether the source is a paragraph, a log, or a rule list, the same approach applies. Before reading the answer choices, read the question stem carefully and form your own answer. Doing this gives you a clearer target before the distractors can pull you off course, which matters here because so many wrong answers are controls that sound right but do not address the weakness.

For any question built on logs, a firewall rule list, or a permission table, find the exact line in question before you start reasoning. Wrong answers are often lifted from neighboring lines: an adjacent firewall rule, a different log entry, a permission on the wrong file. Naming the right line first keeps those traps from catching you. On the hardest items it helps to expect each wrong choice to fail in a different way: one misreads the source, one is a real control that doesn’t fix this particular weakness, one answers a different skill than the stem asked for, and one is just a plausible mistake. When you can name the flaw in each, the right answer is the one left standing.

The Biggest Mistakes Students Make on AP® Cybersecurity Multiple Choice

How to Use These Drills Effectively

The 30 drills below cover the five units of the AP® Cybersecurity course, moving from foundational security and physical spaces through networks, devices, and finally applications and data. Each drill is built around an original scenario, such as a phishing email, a firewall rule list, a permission table, or an incident log, with realistic details and five multiple-choice questions that build from reading the source to identifying a concept or attack, evaluating or configuring a control, reasoning about why, and choosing a mitigation or recommendation.

Two of the drills are cross-source, FRQ-informed multiple-choice sets that practice the kind of multi-source reading used in the Device Security Analysis question, where you reason across firewall rules, logs, permissions, and policy at once. After completing a drill, read every explanation, including the ones for questions you answered correctly. Each explanation names the specific error behind a wrong answer, including the “sounds secure but doesn’t fix it” controls that catch students who skim the scenario too quickly.

If you work through these steadily, they give you repeated practice with the reading, analysis, and decision-making the exam asks for.