Cisco Certified Support Technician (CCST) Cybersecurity — Practice Set 1

Question 1

A company stores customer records in a database. Management wants to ensure that only authorised employees can read those records and that no unauthorised changes can be made. Which two properties of the CIA triad BEST describe these requirements?

Accepted Answer

Confidentiality ensures that only authorised parties can access information, while integrity ensures data is not altered by unauthorised actors. Availability addresses ensuring systems are accessible when needed. Authentication and non-repudiation are security services but are not part of the three-component CIA triad.

Question 2

An employee receives an email that appears to come from the company's bank, asking her to click a link and verify her account credentials. The email was sent to all employees at once. Which type of attack does this BEST describe?

Accepted Answer

Phishing is a broad social-engineering attack sent to many recipients simultaneously, impersonating a trusted entity to steal credentials. Spear-phishing is targeted at a specific individual or organisation. Vishing uses voice calls. Smishing uses SMS text messages.

Question 3

A security analyst reviews a report showing that a web server has an unpatched buffer-overflow flaw. An attacker has not yet targeted the flaw. How are the terms vulnerability, threat, and risk correctly applied to this situation?

Accepted Answer

A vulnerability is a weakness in a system (the unpatched buffer-overflow flaw). A threat is an actor or event that could exploit that weakness (an attacker). Risk is the potential for loss expressed as the combination of the likelihood of exploitation and the resulting impact. These three terms have distinct meanings in security risk assessments.

Question 4

A user logs in to a corporate portal by entering a password and then pressing her fingerprint against a scanner. Which authentication factors are being used?

Accepted Answer

A password is 'something you know' (a knowledge factor). A fingerprint is a biometric, classified as 'something you are' (an inherence factor). 'Something you have' refers to physical tokens or smart cards. 'Somewhere you are' refers to geolocation-based authentication. Together, a password plus biometric constitutes two-factor authentication.

Question 5

A company applies the principle of least privilege to all user accounts. Which statement BEST describes what this principle requires?

Accepted Answer

The principle of least privilege states that a user, process, or system component should be granted only the access rights required to perform its intended function and nothing beyond that. Granting administrator rights to all users violates least privilege. Shared accounts undermine accountability. Identical permissions regardless of role also violate the principle.

Question 6

A network administrator wants to encrypt a large amount of data quickly using a single shared key. Which type of encryption BEST meets this requirement?

Accepted Answer

Symmetric encryption uses the same key for both encryption and decryption. It is significantly faster than asymmetric encryption and is well suited for encrypting large volumes of data. Asymmetric encryption uses a key pair (public/private) and is computationally expensive. Hashing produces a fixed-length digest and is not reversible. Digital signatures provide authentication and non-repudiation but are not used for bulk data encryption.

Question 7

An organisation uses SHA-256 to verify downloaded software packages. A technician asks what property of SHA-256 makes it suitable for this task. Which answer is correct?

Accepted Answer

Hashing algorithms like SHA-256 produce a deterministic, fixed-length output (a digest) from input data. Any modification to the input, even a single bit, results in a radically different digest — this is the avalanche effect. SHA-256 does not encrypt data (it is one-way and not reversible), does not compress files, and does not use asymmetric key pairs.

Question 8

A user wants to send an encrypted message to a colleague using asymmetric encryption. Which key should the sender use to encrypt the message?

Accepted Answer

In asymmetric encryption, a message intended for a specific recipient is encrypted with that recipient's public key. Only the recipient's matching private key can decrypt it. Encrypting with the sender's private key would create a digital signature (providing authentication), not confidentiality. Using the sender's public key provides no confidentiality benefit.

Question 9

A developer wants to ensure that a document she sends can be verified as coming from her and has not been altered. She creates a digital signature. Which cryptographic operations are performed to create and verify this signature?

Accepted Answer

To create a digital signature: the sender hashes the document, then encrypts that hash with their own private key. To verify: the recipient decrypts the signature using the sender's public key to recover the hash, independently hashes the received document, and compares the two hashes. A match proves both authenticity (sender) and integrity (unchanged). This does not provide confidentiality of the document itself.

Question 10

During a TLS 1.2 handshake, a client sends a 'ClientHello' message to a server. What information does the server provide in its 'ServerHello' and 'Certificate' messages that allows the client to authenticate the server and establish a shared secret?

Accepted Answer

In a TLS 1.2 handshake, the ServerHello message carries the chosen cipher suite and session parameters. The Certificate message contains the server's X.509 digital certificate, which holds the server's public key signed by a trusted Certificate Authority (CA). The client uses the CA's trusted root to verify the certificate, authenticating the server. The client then uses the server's public key to securely exchange key material for the symmetric session key. The server never sends its private key.

Question 11

A company wants to move beyond traditional signature-based antivirus to a solution that continuously monitors endpoint behaviour, records all activity, and can detect fileless malware. Which technology BEST meets this requirement?

Accepted Answer

Endpoint Detection and Response (EDR) continuously monitors endpoint activity, records process, network, and file events, and uses behavioural analytics to detect threats including fileless malware that leaves no static signature. Traditional antivirus relies on signature matching against known malware. A host-based firewall controls network traffic at the endpoint but does not perform deep behavioural analysis. DLP focuses on preventing data exfiltration.

Question 12

A security team finds that several workstations were compromised after employees used personal USB drives. Which endpoint security control would MOST directly reduce this risk?

Accepted Answer

Disabling or restricting USB ports through Group Policy (on Windows) or a similar endpoint management policy directly prevents employees from connecting unauthorised removable media. A network-based IDS monitors network traffic and would not detect USB-borne malware before execution. VLAN segmentation addresses network-level isolation. BitLocker protects data on the drive if lost or stolen but does not prevent malware introduced via USB.

Question 13

A systems administrator is tasked with reducing the attack surface of all Windows workstations. She schedules regular patch cycles and removes unnecessary software. Which security principle do these actions MOST directly implement?

Accepted Answer

Regularly applying patches closes known vulnerabilities, and removing unnecessary software reduces the number of attack vectors available to an adversary — these are core patch management and attack surface reduction practices. Defense-in-depth refers to using multiple, layered security controls. Least privilege addresses user and process permissions. Separation of duties requires that critical tasks be divided among multiple individuals.

Question 14

During POST, a laptop checks that the boot loader has not been tampered with before passing control to the operating system. Which feature provides this protection?

Accepted Answer

Secure Boot is a UEFI firmware security standard that verifies the cryptographic signature of each boot component (boot loader, kernel drivers) before execution. If a component has been altered or is unsigned, Secure Boot halts the boot process. BitLocker encrypts the disk but does not verify boot integrity signatures at POST. Windows Defender is an antivirus solution that operates after the OS loads. UAC prompts users for elevation of privilege at runtime.

Question 15

A security analyst notices that a critical system file (C:\Windows\System32\lsass.exe) has a different SHA-256 hash today compared to the baseline recorded last month. No approved change was made. Which endpoint security technology would have automatically flagged this change in real time?

Accepted Answer

File Integrity Monitoring (FIM) continuously computes and compares cryptographic hashes of monitored files against a known-good baseline. Any modification to a monitored file triggers an alert. lsass.exe is a high-value target for credential theft attacks; FIM would detect if an attacker replaced it with a malicious version. NAC controls network access posture. A host-based firewall controls network connections. A VPN client secures remote network access.

Question 16

A company policy states that all employees must run as standard (non-administrative) users on their workstations and must enter administrator credentials to install software. Which security principle does this policy enforce?

Accepted Answer

Running as a standard user and requiring elevation for privileged actions implements the principle of least privilege — users operate with only the permissions necessary for daily tasks, limiting the damage malware or an attacker can cause if a user account is compromised. Defense-in-depth involves layering multiple controls. Non-repudiation ensures actions cannot be denied. Mandatory Access Control (MAC) is a label-based access model used in high-security environments.

Question 17

A network engineer is selecting a firewall for a branch office. The security team requires the firewall to track the state of TCP connections and allow return traffic automatically without creating explicit inbound rules. Which firewall type meets this requirement?

Accepted Answer

A stateful inspection firewall maintains a state table of active connections. When an internal host initiates a TCP session, the firewall records the connection; return traffic is automatically permitted without an explicit inbound rule. A packet-filtering firewall evaluates each packet in isolation without connection context. A proxy firewall operates at the application layer and terminates connections. A WAF specifically protects web applications from HTTP-layer attacks.

Question 18

A security device detects malicious traffic matching a signature and immediately drops the offending packets and resets the connection. Which device type is performing this action?

Accepted Answer

An Intrusion Prevention System (IPS) is deployed inline in the traffic path and can actively block, drop, or reset connections matching attack signatures. An Intrusion Detection System (IDS) is deployed out-of-band; it generates alerts but cannot drop traffic in real time. A packet analyser is a passive capture tool. A SIEM aggregates and correlates log data but does not itself block traffic.

Question 19

A company places its public-facing web servers on a network segment that is separate from the internal corporate network, with firewalls on both sides. What is this network architecture called?

Accepted Answer

A Demilitarised Zone (DMZ) is a perimeter network segment that separates public-facing servers from the internal corporate network. Firewalls on both sides of the DMZ control traffic between the internet, the DMZ, and the internal network, limiting the blast radius if a public server is compromised. VLAN trunking is a Layer 2 technique for carrying multiple VLANs over one link. NAT and PAT translate IP addresses but do not define a network zone architecture.

Question 20

Remote employees need to securely access internal corporate resources over the internet. The company wants each employee's device to establish an encrypted tunnel to the headquarters firewall. Which VPN type is MOST appropriate?

Accepted Answer

A remote-access VPN allows individual client devices to connect securely to a corporate network over the internet by establishing an encrypted tunnel from each device to a VPN gateway. A site-to-site VPN connects two fixed network locations (e.g., two offices) and is not designed for individual roaming clients. An MPLS circuit is a dedicated WAN technology, not an internet-based VPN. A GRE tunnel without encryption provides encapsulation but no confidentiality.

Question 21

A security team deploys a system that looks like a legitimate server but is actually designed to attract and monitor attackers. No production data resides on it. What is this system called and what is its primary purpose?

Accepted Answer

A honeypot is a deliberately vulnerable decoy system placed in a network to attract attackers. Because no legitimate traffic should reach it, any connection is suspicious by definition. Honeypots allow defenders to study attack techniques, gather threat intelligence, and receive early warning of intrusions. A SIEM collects and correlates logs. A DMZ hosts production-facing services. A NAC appliance enforces endpoint health policies before granting network access.

Question 22

A security analyst is following the incident response lifecycle. After an alert is confirmed as a real incident, the team works to limit the spread and minimise damage. Which phase of the incident response process is this?

Accepted Answer

The containment phase immediately follows identification. Its goal is to limit the scope and impact of the incident — for example, isolating an infected host from the network. Preparation involves establishing policies and tools before incidents occur. Identification is the detection and confirmation that an incident has occurred. Recovery involves restoring systems to normal operation after the threat has been eradicated.

Question 23

A forensic investigator must collect evidence from a compromised workstation. According to the order of volatility, which source should be collected FIRST?

Accepted Answer

The order of volatility dictates collecting the most ephemeral data first, because it will be lost soonest. RAM contents (running processes, encryption keys, network connections) disappear when the system is powered off. Hard disk data persists after power-off. Backup tapes and optical media are non-volatile and least likely to change, so they are collected last.

Question 24

During an investigation, a forensic analyst reviews authentication logs and notices multiple successful logins for a user account occurring at 3:00 AM from a foreign country, while the user was confirmed to be in the office at that time. Which term BEST describes this log finding?

Accepted Answer

An Indicator of Compromise (IoC) is an observable artefact or pattern in logs or on a system that indicates a security incident has likely occurred. Logins from an impossible geographic location while the legitimate user is physically elsewhere is a classic IoC suggesting credential theft or account takeover. A false positive is an alert that incorrectly flags benign activity. The scenario describes a security-relevant anomaly, not a routine scheduled task.

Question 25

A forensic investigator seizes a laptop as evidence. Throughout the investigation, every person who accesses the device signs a log recording who accessed it, when, and for what purpose. What is this practice called and why is it critical?

Accepted Answer

Chain of custody is a chronological record documenting every person who has accessed, transferred, or handled a piece of evidence, along with the time, location, and reason. It is essential in legal proceedings because it proves the evidence has not been altered, contaminated, or tampered with from the moment of seizure to its presentation in court. Breaking the chain of custody can render evidence inadmissible. Order of volatility, evidence tagging, and legal hold are related concepts but serve different specific purposes.

100-160 CCSTCYBS — Cisco Certified Support Technician (CCST) Cybersecurity