AP Cybersecurity
AP Cybersecurity / All lessons / Unit 2: Securing Spaces
2Unit 2: Securing Spaces
AP Cybersecurity topic 2.4

Detecting Physical Attacks

Detection tells you an attack happened or is happening. Cameras, motion sensors, door alarms, badge logs, and tamper-evident seals all create evidence. Logs only help if someone reviews them, so organizations set alerts for unusual events like a badge used at 3 a.m.

Detecting Physical Attacks vocabulary

  • Detective control: A control that identifies an attack, like a camera or alarm.
  • Tamper-evident seal: A seal that shows visible damage if opened.
  • Access log: A record of who entered which door and when.
  • Alert: A notification sent when a rule detects suspicious activity.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
Badge log, Westfield Middle School
Sun 03:12  BACK-DOOR    badge #5540 (custodian, retired 2025)  GRANTED
Sun 03:13  OFFICE       badge #5540                             GRANTED
Sun 03:41  BACK-DOOR    door forced open alarm                  ALARM

1. Which of the following is the best evidence of unauthorized physical access?

  1. (A) The back door has a badge reader
  2. (B) A badge belonging to a retired employee was used on a Sunday at 3 a.m.
  3. (C) The office door was opened
  4. (D) The log uses a 24-hour clock
Show answer

(B) A badge belonging to a retired employee was used on a Sunday at 3 a.m. A badge that should have been deactivated was used outside normal hours.

Skill: Mitigate Risk

2. Which of the following changes would most likely have prevented the access shown in the log?

  1. (A) Adding more lights in the parking lot
  2. (B) Deactivating badges as soon as an employee leaves
  3. (C) Painting the back door
  4. (D) Moving the office to the second floor
Show answer

(B) Deactivating badges as soon as an employee leaves Removing access promptly when people leave closes this gap.

Skill: Detect Attacks

3. A school wants a camera that best detects who enters its server room. Where should the camera be placed?

  1. (A) In the parking lot facing the street
  2. (B) Inside the server room facing the door so it captures faces of people entering
  3. (C) In the cafeteria
  4. (D) On the roof facing upward
Show answer

(B) Inside the server room facing the door so it captures faces of people entering Detection controls should cover the entry point of the protected asset with a clear view of people.

Skill: Detect Attacks

4. Which of the following detective controls would reveal that someone opened a sealed equipment cabinet?

  1. (A) Tamper-evident tape on the cabinet doors
  2. (B) A stronger Wi-Fi password
  3. (C) A firewall rule
  4. (D) A warning sign
Show answer

(A) Tamper-evident tape on the cabinet doors Tamper-evident seals show visible damage when opened.

Open 2.4 in the interactive course