AP Cybersecurity
AP Cybersecurity / All lessons / Unit 5: Securing Applications and Data
5Unit 5: Securing Applications and Data
AP Cybersecurity topic 5.6

Detecting Attacks on Data and Applications

Application logs, database audit logs, and file integrity monitoring reveal attacks. Warning signs include many failed logins, unusual database queries, large data transfers at odd hours, and changed files. Hashes let analysts check whether a file has been altered.

Detecting Attacks on Data and Applications vocabulary

  • Audit log: A record of who accessed or changed data.
  • File integrity monitoring: Alerting when important files change unexpectedly.
  • Data exfiltration: Unauthorized copying of data out of an organization.
  • Baseline: A picture of normal activity used to spot differences.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Detect Attacks 
Published checksum for setup.exe (SHA-256):
3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b

$ sha256sum setup.exe
3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1c

1. Which of the following conclusions is best supported?

  1. (A) The file has been altered and should not be installed
  2. (B) The file is identical to the original
  3. (C) The file is encrypted
  4. (D) The hashing algorithm is broken
Show answer

(A) The file has been altered and should not be installed Even a one-character difference in the hash means the file is not the same as the published one.

Skill: Detect Attacks 
Database audit log, gradebook
15:02  user: tlee    SELECT grades WHERE class=Bio2        rows: 28
15:05  user: tlee    SELECT grades WHERE class=Bio3        rows: 31
02:47  user: tlee    SELECT grades (all classes)           rows: 41,200
02:48  user: tlee    EXPORT to external drive

2. Which entry is the strongest indicator of data exfiltration?

  1. (A) The 15:02 query
  2. (B) The 15:05 query
  3. (C) The 02:47 query followed by an export to an external drive
  4. (D) None, because tlee is a teacher
Show answer

(C) The 02:47 query followed by an export to an external drive A late-night query of every record followed by an export breaks the normal baseline for this user.

Skill: Detect Attacks

3. Which detective control would alert administrators when a critical system file is unexpectedly changed?

  1. (A) File integrity monitoring
  2. (B) A visitor badge
  3. (C) A screen privacy filter
  4. (D) A guest Wi-Fi network
Show answer

(A) File integrity monitoring File integrity monitoring compares current hashes to known-good ones.

Skill: Detect Attacks

4. A web application firewall blocks thousands of requests containing "UNION SELECT" from one IP address. Which attack was most likely attempted?

  1. (A) SQL injection
  2. (B) Cross-site scripting
  3. (C) Evil twin
  4. (D) Tailgating
Show answer

(A) SQL injection "UNION SELECT" is SQL syntax used to pull extra data out of a database through injection.

Open 5.6 in the interactive course