AP Cybersecurity
AP Cybersecurity / All lessons / Unit 1: Introduction to Security
1Unit 1: Introduction to Security
AP Cybersecurity topic 1.2

Suspicious Website Logins

Fake login pages copy the look of real sites to harvest usernames and passwords. Check the full domain name, not just the logo. Look-alike domains swap letters (rn for m, 0 for o) or add extra words. HTTPS only means the connection is encrypted, not that the site is honest.

Suspicious Website Logins vocabulary

  • Credential harvesting: Collecting usernames and passwords through a fake login page.
  • Typosquatting: Registering a domain that is a common misspelling of a real one.
  • Domain: The name of a site, read right to left from the top-level domain (for example, .com).
  • HTTPS: An encrypted web connection. It protects data in transit but does not prove a site is legitimate.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
Login history for account: r.patel
08:02:11  SUCCESS  Chromebook  Ohio, US
13:40:02  FAILED   Windows PC  Lagos, NG
13:40:03  FAILED   Windows PC  Lagos, NG
13:40:05  FAILED   Windows PC  Lagos, NG
13:40:06  SUCCESS  Windows PC  Lagos, NG
13:41:30  Password changed

1. Which of the following is the best evidence that the account was compromised by a password attack?

  1. (A) The morning login came from a Chromebook
  2. (B) Rapid failed logins from a new location were followed by a success and a password change
  3. (C) The account name includes the user's last name
  4. (D) All logins happened on the same day
Show answer

(B) Rapid failed logins from a new location were followed by a success and a password change Several quick failures, then a success from an unfamiliar device and place, then a password change, is a typical takeover pattern.

Skill: Analyze Risk

2. A user uses the same password for a gaming forum and a school account. The gaming forum is breached. Which of the following attacks is the school account now most vulnerable to?

  1. (A) Credential stuffing
  2. (B) Shoulder surfing
  3. (C) Tailgating
  4. (D) Directory traversal
Show answer

(A) Credential stuffing In credential stuffing, adversaries try leaked username and password pairs on other sites, which works when passwords are reused.

Skill: Mitigate Risk

3. Which of the following changes would most strengthen authentication for a school's online portal?

  1. (A) Requiring passwords to be changed every week
  2. (B) Allowing users to save passwords in a shared spreadsheet
  3. (C) Requiring a one-time code from an authenticator app in addition to a password
  4. (D) Showing users their password after they type it
Show answer

(C) Requiring a one-time code from an authenticator app in addition to a password Adding a second factor (something you have) means a stolen password alone is not enough to log in.

Skill: Analyze Risk

4. Which of the following best explains why a password like "Summer2026!" is weak even though it meets complexity rules?

  1. (A) It is too long to remember
  2. (B) It follows a common, predictable pattern that attack wordlists include
  3. (C) It uses only uppercase letters
  4. (D) It cannot be hashed
Show answer

(B) It follows a common, predictable pattern that attack wordlists include Season plus year plus symbol is one of the first patterns adversaries try. Predictability matters more than meeting the rules.

Open 1.2 in the interactive course