AP Sınavları
AP Cybersecurity Exam 2027: Format, Units and the Prometric Istanbul Date
What is the new AP Cybersecurity Exam like? 60 multiple-choice questions, one Device Security Analysis question, five units, the skill weightings and why Prometric Istanbul tests it on 18 May 2027.
What is AP Cybersecurity?
AP Cybersecurity is one of the College Board's new AP courses; its Course and Exam Description (CED) is effective from Fall 2026. Students learn to analyse risk, choose security controls and detect attacks across physical spaces, networks, devices, applications and data.
Exam format
| Section | Questions | Time | Share of score |
|---|---|---|---|
| I. Multiple choice | 60 (single questions and sets of 2–4) | 80 minutes | 70% |
| II. Free response: Device Security Analysis | 1 multi-part question | 50 minutes | 30% |
The exam lasts 2 hours 10 minutes and is fully digital in the Bluebook app; responses are submitted automatically at the end.
Multiple-choice section
Questions ask you to analyse scenarios and digital evidence to identify vulnerabilities, recommend mitigations and detect potential threats; some ask you to explain key concepts. All five units are assessed, and questions are spread across three skill categories:
| Skill category | Approximate weighting |
|---|---|
| 1. Analyze Risk | 25–40% |
| 2. Mitigate Risk | 25–40% |
| 3. Detect Attacks | 25–40% |
Sixty questions in 80 minutes is an average of 80 seconds per question. Reading a set's scenario carefully once and answering several questions from it saves time.
Free-response question: Device Security Analysis
You receive several sources from a single device: a set of firewall rules, system and application logs, a list of files with their permissions and a device policy. Using them, you will be asked to:
- Explain parts of the policy
- Find signs of attacks in the logs
- Configure file permissions and firewall rules
- Suggest, with evidence from the sources, how to make the device more secure (hardening)
The question assesses skill categories 2 and 3. One of the CED's task verbs is Write: express a proper command that has the indicated effect. So the section tests whether you can state a configuration correctly, not only whether you know the concepts.
What does the course cover? Five units
- Introduction to Security: how adversaries try to compromise systems, for example through social engineering, and core security principles
- Securing Spaces: vulnerabilities, threats, risk and controls in physical spaces such as a home, a school or a bank
- Securing Networks: risk assessment for networks and detecting attacks by collecting and analysing network data
- Securing Devices: authentication, device settings and indicators of attack in log files
- Securing Applications and Data: application and data security, and detecting attacks on data
When is the exam?
| Where | Date | Start |
|---|---|---|
| College Board general schedule | Wednesday 5 May 2027, session 1 | Set by school or centre |
| Prometric Istanbul | Tuesday 18 May 2027 (late-testing week) | 14:00 local time |
If your school does not offer AP and you test at Prometric Istanbul, your exam falls in the late-testing week. Prometric's fee table lists exams in that week at USD 275 in period 1 (until 6 November 2026) and USD 315 in period 2. See our Prometric Istanbul registration guide for the steps.
Is it the same as AP Computer Science Principles?
No. AP Cybersecurity is a separate course with its own exam. Some resources that appear for "AP Cybersecurity practice test" actually cover the cybersecurity topics of AP Computer Science Principles. Make sure your material matches this exam's format: 60 multiple-choice questions and one Device Security Analysis question. The College Board's official sample questions and scoring guidelines are in the CED.
How to prepare
- Turn the CED into a checklist. Tick off the learning objectives of all five units.
- Practise reading evidence. For sample log lines, file permissions and firewall rules, answer "what is happening here, and what would I change?"
- Time the free response. Write the CED's sample Device Security Analysis question in 50 minutes and compare it with the scoring guidelines.
- Plan around your test date. At Prometric Istanbul the exam is on 18 May; at an AP school it is on 5 May.
Cybersecurity at school, a step ahead at university
For a student drawn to cybersecurity, this course is a chance to take a university-level subject in high school and document it with an official exam score. In Europe, however, which AP Exams count varies by university: TU Eindhoven, for example, lists AP Cybersecurity and AP Business with Personal Finance among the AP Exams it does not accept. Depending on your target, this course may need to be planned as a fifth AP rather than one of the four you need. Let's check against official sources how the new courses are treated for your target programme in a free pre-assessment. If your school does not offer the course, see our AP Cybersecurity course; our practice exam sets are in preparation, and you can join the launch list.