- Based on the text, a logistics startup secures its customer database by applying organizational safe computing practices. Principles include encrypting data, training employees, and keeping audit logs, meaning records of who accessed what and when. Privacy concerns include protecting phone numbers and delivery notes from unnecessary exposure. Security concerns include detecting unauthorized access quickly and limiting damage. The startup enables audit logs and reviews them weekly for unusual patterns. A breach occurs when a former employee's account remains active after departure. The account is used to export customer lists, leading to spam and identity fraud attempts. The company pays investigation costs, faces contractual penalties, and updates its offboarding process (NIST, 2020). What is the purpose of audit logs in the passage?
Answer: They record access activity, helping detect misuse and supporting accountability after a suspected breach.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing requires monitoring and accountability measures like audit logs, which the passage defines as 'records of who accessed what and when.' The passage demonstrates how audit logs help detect unauthorized access when a former employee's account was misused, illustrating their role in both detection and investigation. Choice A is correct because it accurately describes how audit logs record access activity, helping detect misuse and supporting accountability after a suspected breach, which aligns with how the logs revealed unusual patterns from the former employee's account access. Choice C is incorrect because it confuses audit logs with encryption, claiming logs convert data into coded text, when the passage clearly distinguishes these as separate security measures with different purposes - logs record activity while encryption protects data. To help students: Focus on understanding different security controls and their specific functions. Encourage analyzing how monitoring supports both prevention and response. Practice distinguishing between detective controls (audit logs) and protective controls (encryption). Watch for: confusing different security technologies, missing the role of logs in accountability, overlooking the importance of monitoring in security.
- A user receives an email that appears to be from a popular social media site. The email warns that the user's account will be deactivated unless they click a link and enter their login credentials to confirm their identity. This is most likely an attempt at what type of attack?
Answer: A phishing attack
This is a classic example of a phishing attack, which uses deceptive emails and websites to trick users into providing sensitive personal information. Keylogging, rogue access points, and viruses are different types of security threats that do not match the described scenario.
- To access a secure facility, an employee must swipe a keycard and also place their hand on a palm scanner. These two authentication factors fall into which of the following categories, respectively?
Answer: Possession and inherence
A keycard is an example of 'something you have,' which is the possession factor. A palm scan is an example of 'something you are,' which is the inherence factor. Therefore, the two factors are possession and inherence, respectively.
- After browsing a series of websites, a user starts seeing highly specific advertisements related to the content they viewed. This is primarily made possible by which of the following technologies?
Answer: The websites' use of cookies and other trackers to record browsing history.
Targeted advertising relies on tracking technologies like cookies that websites place on a user's browser. These trackers record the user's activity, which is then used to create a profile for delivering specific, relevant ads. This data collection is a key aspect of online privacy.
- A person posts a photograph to their social media account but quickly deletes it. Which of the following statements best explains why the photograph might still be accessible online?
Answer: Deleting a post from one's own view does not always immediately remove it from the platform's servers or from the devices of others who may have saved it.
Once information is placed online, it can be difficult or impossible to remove completely. Data may persist on servers, in backups, or be copied and shared by other users before the original is deleted. The other options are factually incorrect.
- Read the passage. A university uses organizational security to protect student records and research data. Administrators explain that strong password practices include long passphrases, unique passwords per site, and avoiding predictable patterns. They recommend a password manager, which securely stores many passwords in one encrypted vault. Privacy concerns include leaked grades and addresses, while security concerns include credential stuffing, where attackers reuse stolen passwords across services. The university adds two-factor authentication, requiring a password plus a temporary code, and trains staff to recognize phishing. The passage describes a breach where reused passwords allow attackers to access email accounts, leading to fraudulent refund requests and costly investigations (NIST, 2020). What is the purpose of using unique passwords per site in the passage?
Answer: It reduces damage from credential stuffing, since one leaked password cannot unlock other accounts.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses password security practices that protect against credential-based attacks, with unique passwords per site being a critical defense against credential stuffing attacks. The passage provides examples such as the university experiencing a breach where reused passwords allowed attackers to access multiple accounts, leading to fraudulent refund requests and costly investigations. Choice A is correct because it accurately captures how unique passwords limit the damage from credential stuffing attacks - if one site's password database is compromised, the leaked password cannot be used to access the user's accounts on other sites. Choice B is incorrect because it misunderstands the relationship between passwords and phishing - unique passwords don't prevent phishing emails from being sent, they only limit the damage if credentials are compromised. To help students: Focus on understanding different password-related attacks and defenses. Encourage thinking about the interconnected nature of online accounts and cascade effects of breaches. Practice distinguishing between different security measures and what specific threats they address. Watch for: confusion about what password practices protect against, misunderstanding of credential stuffing attacks, and oversimplification of security benefits.
- Read the passage. A manufacturing company connects factory machines to an internal network for monitoring. Safe computing principles require secure configuration, limited access, and continuous patching, meaning installing updates that fix known flaws. Privacy concerns arise when employee badge data is stored alongside machine logs. Security concerns arise when attackers can disrupt production or steal design files. The company uses intrusion detection, meaning software that alerts staff about unusual network behavior. It also performs employee training on suspicious links and unexpected login prompts. A breach occurs when an unpatched server is exploited, and attackers move through the network. Production stops for two days, causing missed orders and overtime costs. The company also faces reputational damage and must review its controls (CISA, 2023). What is the purpose of patching in the passage?
Answer: It fixes known weaknesses in software, reducing the chance attackers exploit outdated systems successfully.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing requires continuous maintenance including patching, which the passage defines as 'installing updates that fix known flaws.' The passage demonstrates how an unpatched server was exploited, leading to production stoppage and significant business impact, illustrating why timely patching is critical. Choice A is correct because it accurately describes how patching fixes known weaknesses in software, reducing the chance attackers exploit outdated systems, which directly addresses the vulnerability that led to the breach where 'an unpatched server is exploited.' Choice C is incorrect because it makes unrealistic guarantees about production continuity and ignores that patching addresses software vulnerabilities, not user configuration errors, demonstrating a common misconception about the scope of security measures. To help students: Focus on understanding the purpose and limitations of each security measure. Encourage analyzing how vulnerabilities are discovered and fixed through the patching process. Practice distinguishing between different types of security controls and their specific purposes. Watch for: making absolute claims about security, confusing different security measures' functions, missing the ongoing nature of security maintenance.
- Which of the following best describes the primary difference between the purposes of authentication and encryption?
Answer: Authentication verifies that a user is who they claim to be, while encryption makes data unreadable to unauthorized parties.
Authentication is the process of verifying identity (e.g., with a password or fingerprint). Encryption is the process of encoding data to prevent unauthorized access. The two are distinct but complementary security measures.
- Which of the following statements best distinguishes a computer virus from the broader category of malware?
Answer: A computer virus is designed to attach to legitimate programs and replicate itself, while malware is a general term for any malicious software.
A computer virus is a specific type of malware characterized by its ability to replicate and attach itself to other files or programs. Malware is the overarching term that includes viruses, spyware, ransomware, and other malicious software.
- Read the passage. During a Personal Data Security seminar, a presenter defines safe computing as protecting accounts, devices, and shared data through careful habits. Privacy concerns include oversharing photos that reveal routines and locations. Security concerns include malware that quietly copies contacts and phishing emails that request "urgent" password resets. Ethical implications include seeking consent before posting others' information and warning friends about scams. The passage mentions the 2018 Marriott breach, which exposed travel-related personal details and increased fraud risk (Information Commissioner's Office [ICO], 2020). What is the purpose of using unique passwords in the passage?
Answer: It ensures a breach of one site does not automatically compromise accounts on other sites.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses practices like using unique passwords for different accounts to prevent cascading security failures when breaches occur. The passage mentions the 2018 Marriott breach which exposed personal details and increased fraud risk, illustrating why password compartmentalization is crucial. Choice A is correct because it accurately captures the purpose of using unique passwords - ensuring that a breach of one site does not automatically compromise accounts on other sites, which directly addresses the security principle of limiting damage from individual breaches. Choice B is incorrect because it suggests storing passwords in plain text on shared computers is safe, which contradicts fundamental security practices, a common error when students misunderstand that unique passwords alone don't eliminate all security requirements. To help students: Focus on understanding defense-in-depth strategies. Encourage analyzing how password reuse creates vulnerability chains. Practice recognizing the importance of password management tools. Watch for: assuming one security measure eliminates the need for others, misunderstanding password storage best practices, underestimating breach impacts.
- Even if an email appears to be from a known sender, what is the most significant security risk of opening an unexpected file attachment?
Answer: The sender's email account could have been compromised, and the attachment may contain malware.
Email accounts can be compromised and used to send malware to contacts. Therefore, an unexpected attachment, even from a known sender, poses a significant risk of containing a virus or other malicious software.
- Read the passage. A city library uses an online portal for patrons to reserve books and pay small fees. Safe computing principles include protecting accounts, limiting stored data, and monitoring for misuse. Privacy concerns involve reading histories and contact information, which can reveal sensitive preferences. Security concerns include account takeover and unauthorized purchases. The library adds rate limiting, meaning the system slows repeated login attempts to deter guessing. It also adopts two-factor authentication for staff accounts. A breach occurs when attackers repeatedly guess weak patron passwords, then change email addresses and lock users out. The library resets accounts, refunds fees, and faces reputational damage due to lost trust (FTC, 2022). What is the purpose of rate limiting in the passage?
Answer: It slows repeated login attempts, making password guessing harder and reducing account takeover risk.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing includes defensive measures like rate limiting, which the passage defines as 'the system slows repeated login attempts to deter guessing.' The passage shows how attackers exploited weak passwords through repeated guessing, demonstrating why rate limiting is an important defense against brute force attacks. Choice A is correct because it accurately describes how rate limiting slows repeated login attempts, making password guessing harder and reducing account takeover risk, which directly addresses the attack method used in the breach where 'attackers repeatedly guess weak patron passwords.' Choice C is incorrect because it claims rate limiting increases guessing speed to help users, which is the opposite of its actual purpose and would make systems more vulnerable to the exact attack described in the passage. To help students: Focus on understanding how technical controls defend against specific attack methods. Encourage analyzing the relationship between attack techniques and defensive measures. Practice identifying how security measures balance usability with protection. Watch for: misunderstanding security measures as helping attackers, confusing the purpose of defensive controls, missing the connection between vulnerabilities and countermeasures.
- Many successful phishing attacks rely on social engineering. Which of the following is the best example of a social engineering tactic?
Answer: Sending an email that creates a sense of urgency, such as a warning that an account will be closed, to rush a user into clicking a link.
Social engineering is the use of psychological manipulation to trick people into divulging confidential information or performing actions. Creating a sense of urgency is a common tactic to bypass a person's normal security cautiousness. The other options describe technical attacks, not social engineering.
- Read the passage. A student technology club discusses Personal Data Security: safe computing includes logging out on shared devices, using screen locks, and verifying app sources. Privacy concerns include someone accessing saved accounts on a public computer. Security concerns include malware from unofficial app stores and phishing links sent through group chats. Ethical implications include protecting classmates' work and not viewing files left open. The text recalls the 2012 LinkedIn breach, where leaked passwords were later reused for other attacks (Krebs, 2016). Based on the passage, how can individuals improve their data security?
Answer: Install apps only from trusted sources and log out when using public devices.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses practices like logging out on shared devices, using screen locks, and verifying app sources to protect data integrity and privacy in shared environments. The passage emphasizes both personal security measures and ethical considerations when using shared resources, noting how the 2012 LinkedIn breach led to password reuse attacks. Choice B is correct because it accurately captures safe computing practices by combining two key principles from the passage - installing apps only from trusted sources (addressing malware concerns) and logging out when using public devices (addressing privacy concerns on shared computers). Choice A is incorrect because leaving accounts signed in on shared computers directly contradicts the passage's emphasis on logging out to protect privacy, a common error when students prioritize convenience over security in shared environments. To help students: Focus on identifying comprehensive security practices for different contexts. Encourage analyzing risks specific to shared computing environments. Practice recognizing the importance of both software security and user behavior. Watch for: prioritizing convenience in shared spaces, misunderstanding multi-user security risks, assuming trust eliminates security needs.
- Read the passage. A regional bank improves organizational security by applying safe computing principles: least privilege, regular updates, and careful data handling. Least privilege means each worker receives only the access needed for their job. Privacy concerns include limiting who can view account numbers and contact details. Security concerns include stopping unauthorized transfers and keeping systems reliable. The bank encrypts stored data, meaning it is scrambled and unreadable without a key. It also encrypts data in transit, meaning information is protected while moving across networks. Employees complete training on phishing and social engineering, which is manipulation that pressures people into sharing secrets. A breach occurs when a manager approves an urgent request without verifying the sender. Attackers reroute payments, causing financial losses and customer distress. The bank reimburses customers, hires auditors, and reports the incident under breach notification rules (Federal Trade Commission [FTC], 2022). Ethical implications include balancing convenience with strong safeguards that prevent foreseeable harm. What is the purpose of least privilege in the passage?
Answer: It limits user access to necessary resources, reducing damage if an account becomes compromised.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses access control principles like least privilege, which limits each user's access to only what they need for their job responsibilities. The passage explicitly defines least privilege as meaning 'each worker receives only the access needed for their job,' illustrating how this principle reduces potential damage from compromised accounts. Choice B is correct because it accurately captures how least privilege limits user access to necessary resources, reducing damage if an account becomes compromised, which aligns with the passage's emphasis on minimizing the impact of security breaches. Choice A is incorrect because it contradicts the fundamental concept of least privilege by suggesting everyone should access all systems, which would maximize rather than minimize potential damage from a breach. To help students: Focus on understanding the principle of minimizing access to reduce risk. Encourage analyzing how security principles balance functionality with protection. Practice identifying how different principles work together (least privilege with encryption and training). Watch for: misunderstanding that more access equals better security, confusing convenience with security, missing how principles complement each other.
- A user logs into a website by providing a password. The website then sends a temporary numeric code to the user's smartphone, which the user must also enter to gain access. This process is an example of which security measure?
Answer: Multifactor authentication, because it requires evidence from two different categories of credentials.
This is an example of multifactor authentication because it requires two distinct factors: something the user knows (the password) and something the user has (the smartphone receiving the code). The other options describe different, unrelated security concepts.
- A student downloads a free software program from a website that is not the official developer's site. Which of the following is a significant security risk associated with this action?
Answer: The download might be bundled with malware that could compromise the student's computer.
Untrustworthy websites are common sources for software bundled with malware. This is a primary security risk, as the hidden malicious software can steal data, damage the system, or perform other harmful actions. The other options are potential inconveniences but not direct security threats.
- Based on the text, a shipping company follows safe computing principles by updating systems, using secure configurations, and monitoring access. Privacy concerns involve protecting customer addresses and delivery histories from unnecessary exposure. Security concerns involve preventing attackers from changing routes or stealing payment details. The company uses encryption, which turns readable data into coded text without the key. It also runs employee training on phishing, explaining that phishing uses fake messages to trick workers. The company performs regular backups, which are saved copies used for recovery. A breach occurs when backups are stored without encryption on a cloud folder with a public link. Attackers download the files and post samples online, causing reputational damage and customer complaints. The company pays for incident response, faces contractual penalties, and must notify affected customers (NIST, 2020). Which example best demonstrates the ethical implications of safe computing?
Answer: Leaders encrypt backups and restrict links, because preventing foreseeable customer harm outweighs minor inconvenience.
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses ethical responsibilities to protect user data beyond mere compliance, considering the real harm that can result from data breaches. The passage emphasizes how unencrypted backups with public links led to reputational damage and customer complaints, illustrating the importance of proactive security measures. Choice A is correct because it demonstrates ethical computing by showing leaders encrypting backups and restricting links to prevent foreseeable customer harm, even if it causes minor inconvenience, which aligns with the passage's emphasis on ethical implications including preventing foreseeable harm. Choice B is incorrect because it shows negligence and disregard for customer privacy, directly contradicting the ethical principle of protecting customer data from unnecessary exposure mentioned in the passage. To help students: Focus on identifying ethical responsibilities beyond legal requirements. Encourage analyzing the balance between convenience and security. Practice recognizing how technical decisions have ethical implications. Watch for: confusing legal compliance with ethical responsibility, missing the human impact of security decisions, overlooking preventable vulnerabilities.
- Which of the following is a primary characteristic of a strong password?
Answer: It is a long sequence of varied characters, including letters, numbers, and symbols.
A strong password is difficult for others to guess and for computers to crack. This is best achieved by using a long password with a mix of character types. The other options describe practices that lead to weak, easily compromised passwords.
- When a user connects to their bank's website, their browser shows a lock icon, indicating a secure connection. This security is partially enabled by a trusted third party. What is the role of this third party, known as a certificate authority?
Answer: To issue a digital certificate that verifies the website's identity and ownership of its public key.
Certificate authorities issue digital certificates to validate that a website is who it claims to be. This allows the user's browser to trust the website's public key and establish a secure, encrypted connection. They do not monitor transactions, speed up connections, or store passwords.
