AP Cybersecurity
AP Cybersecurity / All lessons / Unit 4: Securing Devices
4Unit 4: Securing Devices
AP Cybersecurity topic 4.1

Device Vulnerabilities and Attacks

Devices are attacked through unpatched software, weak or default passwords, and malware. Malware types include viruses (attach to files), worms (spread by themselves), trojans (pretend to be useful), ransomware (encrypt files for payment), and spyware or keyloggers (watch what you do).

Device Vulnerabilities and Attacks vocabulary

  • Malware: Software designed to harm or take control of a system.
  • Ransomware: Malware that encrypts files and demands payment.
  • Worm: Malware that spreads across networks on its own.
  • Zero-day: A vulnerability unknown to the vendor, so no patch exists yet.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks

1. After a student opens an attachment, every file on the shared drive is renamed with ".locked" and a note demands payment in cryptocurrency. Which type of malware is this?

  1. (A) Spyware
  2. (B) Ransomware
  3. (C) Adware
  4. (D) Rootkit
Show answer

(B) Ransomware Ransomware encrypts files and demands payment for the key.

Skill: Detect Attacks

2. Malware spreads from one unpatched computer to others on the network without anyone opening a file. Which type of malware is this?

  1. (A) Trojan
  2. (B) Worm
  3. (C) Keylogger
  4. (D) Logic bomb
Show answer

(B) Worm Worms self-replicate across networks by exploiting vulnerabilities.

Skill: Analyze Risk

3. A smart thermostat in a school office still uses its factory password and connects to the main network. Which of the following best explains the risk?

  1. (A) The thermostat could display the wrong temperature
  2. (B) An adversary could log in with the known password and use the device as a foothold into the network
  3. (C) The thermostat will use more electricity
  4. (D) The thermostat will stop receiving weather updates
Show answer

(B) An adversary could log in with the known password and use the device as a foothold into the network IoT devices with default credentials are easy footholds for lateral movement.

Skill: Analyze Risk

4. A vendor announces a vulnerability in its tablet operating system, but a patch will not be ready for two weeks. Which term describes the vulnerability during that time?

  1. (A) Zero-day vulnerability
  2. (B) False positive
  3. (C) Social engineering
  4. (D) Integrity check
Show answer

(A) Zero-day vulnerability A zero-day is a flaw with no available fix yet.

Open 4.1 in the interactive course