AP Cybersecurity
AP Cybersecurity / All lessons / Unit 2: Securing Spaces
2Unit 2: Securing Spaces
AP Cybersecurity topic 2.2

Physical Vulnerabilities and Attacks

If an attacker can touch a device, many digital protections stop mattering. Physical attacks include tailgating, stealing laptops, plugging in malicious USB drives, shoulder surfing, and dumpster diving for printed passwords or documents.

Physical Vulnerabilities and Attacks vocabulary

  • Shoulder surfing: Watching someone type a password or PIN.
  • Dumpster diving: Searching trash for useful information.
  • Baiting: Leaving infected USB drives where victims will find and plug them in.
  • Badge cloning: Copying the signal from an access card.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks

1. An employee sees a stranger carrying a large box walk in right behind a coworker after the coworker badges through a secure door. Which of the following attacks is occurring?

  1. (A) Shoulder surfing
  2. (B) Tailgating
  3. (C) Dumpster diving
  4. (D) Badge cloning
Show answer

(B) Tailgating Following an authorized person through a secured entrance without badging is tailgating.

Skill: Analyze Risk 
Walkthrough notes, Eastbrook Clinic
1. Patient records printed and stacked next to the lobby printer
2. Break room door has no lock; contains a microwave and fridge
3. Visitor Wi-Fi password posted on the lobby wall
4. Network closet propped open with a chair during cleaning

2. Which of the following findings would most likely be documented as the highest risk?

  1. (A) Finding 2
  2. (B) Finding 3
  3. (C) Finding 4
  4. (D) All findings are equal risk
Show answer

(C) Finding 4 An open network closet exposes core infrastructure to anyone. The break room holds no sensitive assets, and visitor Wi-Fi is meant to be shared.

Skill: Analyze Risk

3. Which of the following best explains how an adversary could use the printed patient records in finding 1?

  1. (A) The records could cause the printer to overheat
  2. (B) Anyone in the lobby could read or take sensitive data, violating confidentiality
  3. (C) The records would slow down the clinic network
  4. (D) The records would delete themselves from the server
Show answer

(B) Anyone in the lobby could read or take sensitive data, violating confidentiality Unattended printouts can be read or stolen without any technical skill.

Skill: Detect Attacks

4. A security guard finds sticky notes with passwords in a recycling bin outside the building. Which attack does this make possible?

  1. (A) Dumpster diving
  2. (B) Phishing
  3. (C) SQL injection
  4. (D) Evil twin
Show answer

(A) Dumpster diving Searching trash for useful information is dumpster diving. Shredding and clean-desk policies prevent it.

Open 2.2 in the interactive course