AP Cybersecurity
AP Cybersecurity / All lessons / Unit 4: Securing Devices
4Unit 4: Securing Devices
AP Cybersecurity topic 4.4

Detecting Attacks on Devices

Signs of compromise include unexpected pop-ups, slow performance, unknown programs, disabled security tools, odd network connections, and unfamiliar login alerts. Endpoint detection and response (EDR) tools and system logs help analysts confirm an infection and contain it, for example by disconnecting the device.

Detecting Attacks on Devices vocabulary

  • Indicator of compromise (IoC): Evidence that a system may have been breached.
  • EDR: Endpoint detection and response: tools that monitor and respond on devices.
  • Containment: Isolating a system to stop an attack from spreading.
  • Event log: A record of actions on a device, like logins and installs.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
Windows Security log, LIB-PC-07
22:01:10  Event 4625  Logon failed   user: administrator
22:01:11  Event 4625  Logon failed   user: administrator
22:01:11  Event 4625  Logon failed   user: administrator
... (312 more in 4 minutes)
22:05:43  Event 4624  Logon success  user: administrator

1. Which of the following is indicated by this log?

  1. (A) A successful brute-force password attack
  2. (B) A normal software update
  3. (C) A user who forgot their password once
  4. (D) A printer error
Show answer

(A) A successful brute-force password attack Hundreds of rapid failures followed by a success is the signature of a brute-force attack that worked.

Skill: Detect Attacks

2. Which of the following controls would have alerted staff during the attack in the log?

  1. (A) An alert rule for many failed logins in a short time
  2. (B) A brighter monitor
  3. (C) A visitor sign-in sheet
  4. (D) A longer screen saver timeout
Show answer

(A) An alert rule for many failed logins in a short time Thresholds on failed logins detect password attacks in progress.

Skill: Detect Attacks

3. A laptop suddenly runs slowly, its antivirus has been disabled, and an unknown program starts at boot. Which of the following best describes these signs?

  1. (A) Indicators of compromise
  2. (B) Managerial controls
  3. (C) Firewall rules
  4. (D) Encryption keys
Show answer

(A) Indicators of compromise These are evidence that the device may be infected.

Skill: Mitigate Risk

4. An analyst confirms that a laptop is infected and is beaconing to an outside server. What should happen first?

  1. (A) Isolate the laptop from the network
  2. (B) Delete the logs to save space
  3. (C) Post the issue on social media
  4. (D) Wait a week to see if it stops
Show answer

(A) Isolate the laptop from the network Containment stops spread and data theft while the investigation continues.

Open 4.4 in the interactive course