Cisco Certified Support Technician (CCST) Cybersecurity 100-160 CCST Cybersecurity Exam Questions

Page: 1 / 14
Total 50 questions
Question 1

You are going to perform a penetration test on a company LAN. As part of your preparation, you access the company's websites, view webpage source code, and run internet searches to uncover domain information. You also use social media to gather details about the company and its employees.

Which type of reconnaissance activities are you performing?



Answer : A

The CCST Cybersecurity Study Guide explains that reconnaissance is the process of collecting information about a target before attempting exploitation.

'Passive reconnaissance is conducted without directly engaging with the target systems. Examples include reviewing public websites, examining HTML source code, querying public DNS records, and using social media to gather information. Since no packets are sent directly to the target system, it reduces the risk of detection.'

(CCST Cybersecurity, Vulnerability Assessment and Risk Management, Reconnaissance Techniques section, Cisco Networking Academy)

Passive (A) is correct because all actions described --- viewing public pages, searching online, and checking social media --- involve no direct interaction that could alert the target.

Active (B) would involve direct probing, like port scans or vulnerability scans.

Offline (C) is not an official reconnaissance classification in this context.

Invasive (D) is a general term and not used as a standard reconnaissance category in CCST material.


Question 2

A threat actor sets up a rogue access point (AP) at a local cafe. The rogue AP captures traffic and then forwards the traffic to the cafe AP.

Which type of attack does this scenario describe?



Answer : B

The CCST Cybersecurity Study Guide describes a man-in-the-middle (MITM) attack as an attack where the adversary secretly intercepts and possibly alters communications between two parties, making them believe they are communicating directly. A rogue AP configured to pass traffic through itself before sending it on is a classic wireless MITM method.

'In a MITM attack, the attacker places themselves between the sender and receiver, intercepting and possibly altering data in transit. Rogue access points can facilitate MITM attacks in wireless environments.'

(CCST Cybersecurity, Basic Network Security Concepts, Wireless Threats section, Cisco Networking Academy)

A is incorrect: Reconnaissance is information gathering, not active interception.

B is correct: This is a wireless MITM attack.

C is incorrect: DDoS aims to overwhelm a service, not intercept data.

D is incorrect: Ransomware encrypts data for extortion.


Question 3

You are collecting data after a suspected intrusion on the local LAN.

You need to capture incoming IP packets to a file for an investigator to analyze.

Which two tools should you use? (Choose 2.)



Answer : A, B

The CCST Cybersecurity Study Guide specifies that both Wireshark and tcpdump are packet capture tools that can record network traffic to a file for later analysis.

'Wireshark provides a graphical interface for packet capture and analysis. Tcpdump is a command-line tool that captures packets for detailed offline review.'

(CCST Cybersecurity, Incident Handling, Network Traffic Analysis section, Cisco Networking Academy)

A is correct: Wireshark is widely used for packet capture and analysis.

B is correct: tcpdump is a CLI-based packet capture tool.

C (Nmap) is for network scanning, not packet capture.

D (netstat) displays network connections and ports but does not capture packets.


Question 4

An administrator wants to ensure that any files downloaded from the internet are automatically scanned for malicious code before execution. Which security control should be implemented?



Answer : B

According to the CCST Cybersecurity course, anti-malware solutions with real-time protection scan files as they are downloaded or opened, blocking malicious code before it runs.

'Real-time protection automatically inspects files, applications, and scripts as they are accessed or downloaded, preventing execution of malicious code.'

(CCST Cybersecurity, Endpoint Security Concepts, Malware Protection section, Cisco Networking Academy)


Question 5

Your supervisor tells you that you will participate in a CVSS assessment.

What will you be doing?



Answer : D

The CCST Cybersecurity Study Guide explains that CVSS (Common Vulnerability Scoring System) is a standardized method for rating the severity of software vulnerabilities. It considers exploitability, impact, and environmental factors.

'The Common Vulnerability Scoring System (CVSS) provides a numerical score that reflects the severity of a vulnerability, enabling prioritization of remediation efforts.'

(CCST Cybersecurity, Vulnerability Assessment and Risk Management, Vulnerability Scoring section, Cisco Networking Academy)


Question 6

Which encryption type is commonly used to secure WiFi networks?



Answer : C

The CCST Cybersecurity Study Guide specifies that AES (Advanced Encryption Standard) is the encryption method used in modern WiFi security protocols like WPA2 and WPA3.

'WPA2 and WPA3 use the Advanced Encryption Standard (AES) for securing wireless traffic. AES provides strong symmetric encryption, replacing outdated methods like WEP and TKIP.'

(CCST Cybersecurity, Basic Network Security Concepts, Wireless Security section, Cisco Networking Academy)

A (DES) is outdated and insecure.

B (Triple DES) is older and slower, rarely used in WiFi.

C is correct: AES is the industry standard for WiFi security.

D (RSA) is asymmetric encryption used in key exchange, not bulk WiFi encryption.


Question 7

During an incident response, the security team needs to isolate a compromised server from the rest of the network but still allow forensic analysis. Which action should they take?



Answer : B

The CCST Cybersecurity course notes that isolation is a key part of the containment phase of incident response. The goal is to prevent the compromised system from communicating with the attacker or spreading malware, while preserving it for analysis.

'Containment often involves removing an affected system from the production network and connecting it to a controlled forensic environment to preserve evidence and prevent further compromise.'

(CCST Cybersecurity, Incident Handling, Containment Procedures section, Cisco Networking Academy)


Page:    1 / 14   
Total 50 questions