AP Cybersecurity
AP Cybersecurity / All lessons / Unit 1: Introduction to Security
1Unit 1: Introduction to Security
AP Cybersecurity topic 1.1

Understanding Social Engineering

Social engineering attacks target people instead of technology. Attackers use urgency, fear, authority, curiosity, or helpfulness to get someone to click a link, share a password, or hold a door open. The best defense is slowing down and verifying requests through a separate, trusted channel.

Understanding Social Engineering vocabulary

  • Phishing: A message that pretends to come from a trusted source to steal information or install malware.
  • Pretexting: Inventing a believable story (a pretext) to get someone to share information.
  • Tailgating: Following an authorized person through a secure door without badging in.
  • Spear phishing: Phishing aimed at one specific person or group, using details about them.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
From: Coach Daniels <coach.daniels.athletics@gmail.com>
To: Team Parents
Subject: Last chance: tournament fee

Only 3 spots remain for this weekend's tournament bus. Spots are
first come, first served. Send the $40 fee by gift card code to
this email within 2 hours to hold your child's seat.

1. Which of the following best describes the social engineering tactic used in the line "Only 3 spots remain"?

  1. (A) Authority, because the message comes from a coach
  2. (B) Scarcity, because it suggests the opportunity is limited and may be lost
  3. (C) Consensus, because it suggests other parents have already paid
  4. (D) Familiarity, because parents know the coach
Show answer

(B) Scarcity, because it suggests the opportunity is limited and may be lost Telling the reader that few spots are left creates scarcity. The two-hour deadline adds urgency on top of it.

Skill: Detect Attacks

2. Which of the following is the strongest indicator that the email above is a phishing attempt?

  1. (A) It is addressed to a group of parents
  2. (B) It mentions a weekend event
  3. (C) It asks for payment by gift card code from a personal email account
  4. (D) It includes a dollar amount
Show answer

(C) It asks for payment by gift card code from a personal email account Requests for gift cards from personal accounts are a classic sign of fraud. Real school fees go through official payment systems.

Skill: Analyze Risk

3. A receptionist receives a call from someone claiming to be a new IT technician who needs the front-desk computer password to "finish an update." Which of the following is the most likely impact if the receptionist provides the password?

  1. (A) The phone line could be overloaded with calls
  2. (B) An adversary could log in as the receptionist and access systems that account can reach
  3. (C) The computer's update would install more slowly
  4. (D) The receptionist's email would be deleted automatically
Show answer

(B) An adversary could log in as the receptionist and access systems that account can reach Sharing credentials lets an adversary impersonate the victim and use every system the account can access.

Skill: Mitigate Risk

4. Which of the following actions would best protect an employee who receives an unexpected request to change a vendor's bank account details?

  1. (A) Reply to the email to confirm the change
  2. (B) Call the vendor using a phone number already on file
  3. (C) Forward the email to coworkers for their opinion
  4. (D) Make the change and monitor the account later
Show answer

(B) Call the vendor using a phone number already on file Verifying through a separate, trusted channel defeats impersonation. Replying to the same email reaches the adversary.

Open 1.1 in the interactive course