Cisco CCST Cybersecurity (100-160) Practice Exam

What the Cisco CCST Cybersecurity (100-160) exam covers

• Essential Security Principles198 questions
• Basic Network Security Concepts193 questions
• Endpoint Security Concepts180 questions
• Vulnerability Assessment and Risk Management161 questions
• Incident Handling152 questions

Free Cisco CCST Cybersecurity (100-160) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 884.

1. Question 1Essential Security Principles

   What does the CIA triad stand for?

   • AConfidentiality, Identity, Authentication
   • BConfidentiality, Integrity, AvailabilityCorrect
   • CCompliance, Integrity, Auditing
   • DControl, Identity, Access
   ✓ Correct answer: B

   The CIA triad is the foundational security model used across cybersecurity. Confidentiality ensures that data is accessible only to authorized parties. Integrity ensures that data has not been altered by unauthorized parties. Availability ensures that systems and data are accessible when needed by legitimate users.

   Why the other options are wrong

   • AConfidentiality, Identity, Authentication is not the CIA triad - Identity and Authentication are access control concepts, not CIA triad components.
   • CCompliance, Integrity, Auditing replaces two of the three correct components - Compliance and Auditing are security practices but are not part of the CIA triad.
   • DControl, Identity, Access describes access management concepts, not the three pillars of the CIA triad.
2. Question 2Essential Security Principles

   Why is automating routine compliance/security checks more cost-effective than manual periodic audits alone?

   • AAutomation lets you audit only once a year instead of continuously
   • BAutomation transfers audit accountability entirely to the tool vendor
   • CAutomation removes the need to define secure configuration baselines
   • DContinuous checks catch drift early and cheaply, cutting later remediation costCorrect
   ✓ Correct answer: D

   Automated compliance and security checks - such as configuration drift detection, CIS Benchmark scanning, and policy-as-code enforcement in pipelines - run continuously at near-zero marginal cost per check once deployed. They surface deviations from secure baselines within minutes of their introduction, when correction is cheap. Manual periodic audits, by contrast, may not detect drift for weeks or months, during which time the exposure window grows and remediation complexity increases significantly.

   Why the other options are wrong

   • AAutomation enables continuous checking, not a single infrequent audit.
   • BAccountability for compliance stays with the organization, not the tool vendor.
   • CAutomated checks measure against baselines, so those baselines must still be defined.
3. Question 3Incident Handling

   An analyst hashes a disk image immediately after acquisition and again later, and the hashes match. This demonstrates:

   • AThe malware has been removed
   • BThe image was not altered, supporting evidence integrityCorrect
   • CThe network has been segmented
   • DThe attacker has been identified
   ✓ Correct answer: B

   Matching hashes demonstrate that the image has not been altered since acquisition. This proves chain of custody and evidence integrity, which is critical for forensic validity.

   Why the other options are wrong

   • AMatching hashes prove the image is unchanged; they say nothing about whether malware was removed from the source system.
   • CHash matching validates image integrity, not whether the network was segmented, which is an unrelated containment action.
   • DA matching hash confirms the evidence is intact but provides no information identifying who the attacker was.
4. Question 4Endpoint Security Concepts

   A user reports their antivirus has been disabled and cannot be re-enabled, and several security tools fail to launch. What does this MOST likely indicate?

   • AThe keyboard layout was changed
   • BThe antivirus license simply expired and all is well
   • CMalware is actively tampering with security software on the hostCorrect
   • DThe screen brightness is too low
   ✓ Correct answer: C

   Antivirus being disabled and security tools failing to launch indicates the system is actively compromised. Malware often tampers with security software.

   Why the other options are wrong

   • AA keyboard layout change only affects how typed characters map; it cannot disable antivirus or stop security tools from launching.
   • BAn expired antivirus license typically halts signature updates but leaves the product running; it would not block multiple security tools from starting.
   • DScreen brightness is a display setting with no effect on whether security software runs or can be re-enabled.
5. Question 5Essential Security Principles

   In access control terminology, what is the difference between authentication and authorization?

   • AAuthentication verifies identity; authorization determines what the verified identity is permitted to doCorrect
   • BAuthentication grants permissions; authorization proves identity
   • CThey are interchangeable terms for the same login process
   • DAuthentication applies only to devices, while authorization applies only to users
   ✓ Correct answer: A

   Authentication is the process of verifying a claimed identity, such as checking a password or biometric. Authorization happens after authentication and determines the resources and actions the authenticated subject is permitted to use, based on assigned rights or roles.

   Why the other options are wrong

   • BThis reverses the definitions; authentication proves identity and authorization grants permissions.
   • CThey are distinct steps: identity verification versus permission enforcement.
   • DBoth authentication and authorization apply to users, services, and devices alike.
6. Question 6Basic Network Security Concepts

   A security team wants every device, user, and application authenticated and authorized before any session is allowed, regardless of whether the request originates inside or outside the corporate network. Which security model does this BEST describe?

   • APerimeter-based defense relying on a trusted internal zone
   • BZero trust, where no implicit trust is granted by network locationCorrect
   • CAir-gapping all sensitive systems from the network
   • DDefense in depth using only layered antivirus products
   ✓ Correct answer: B

   Zero trust assumes no implicit trust based on network position; every user, device, and application must be verified and explicitly authorized for each session. This contrasts sharply with the older 'trust the inside, distrust the outside' perimeter model and directly matches the scenario's requirement to validate requests from both inside and outside the network.

   Why the other options are wrong

   • APerimeter-based defense grants implicit trust to anything already inside the network, which is the opposite of the scenario's requirement.
   • CAir-gapping physically isolates systems and does not describe a model that authenticates and authorizes network sessions.
   • DDefense in depth is a layering strategy and antivirus alone does not enforce per-request authentication and authorization.
7. Question 7Endpoint Security Concepts

   Which statement BEST describes how a Host-based Intrusion Prevention System (HIPS) differs from traditional signature-based antivirus on an endpoint?

   • AHIPS can block suspicious behavior and exploit attempts in real time, not just match known malware signaturesCorrect
   • BHIPS scans files only against a signature database and cannot judge behavior
   • CHIPS filters traffic purely by source and destination port numbers
   • DHIPS forwards endpoint events to a SIEM but takes no local action
   ✓ Correct answer: A

   A HIPS observes system calls, memory operations, and process behavior, blocking actions that match attack patterns even for unknown threats. This behavior-based, inline protection complements signature antivirus, which only catches previously cataloged malware. The two are layered for defense in depth.

   Why the other options are wrong

   • BSignature-only matching describes traditional antivirus, which is exactly what HIPS goes beyond.
   • CFiltering by port is a firewall behavior, not the behavioral blocking HIPS performs.
   • DForwarding events to a SIEM is passive telemetry, whereas HIPS actively blocks suspicious behavior locally.
8. Question 8Incident Handling

   Before powering down a Linux host for imaging, a responder must capture volatile data in the correct order. According to the order of volatility, which of the following should generally be collected FIRST?

   • ACPU registers, cache, and memory contentsCorrect
   • BFiles archived on offline backup tapes
   • CData on the hard disk
   • DConfiguration files stored on the local filesystem
   ✓ Correct answer: A

   The order of volatility (RFC 3227) directs responders to collect the most ephemeral data first because it is lost soonest. CPU registers and cache are the most volatile, followed by memory and network state, then disk and finally archival media, which are the most stable.

   Why the other options are wrong

   • BOffline backup tapes are among the most stable evidence and are collected last, not first.
   • CHard-disk data persists across reboots, so it is collected after volatile memory state.
   • DConfiguration files on disk are non-volatile and remain available after power loss, so they are not first.
9. Question 9Basic Network Security Concepts

   A mail administrator wants email clients to retrieve messages over an encrypted connection. Which protocol and port pairing provides IMAP secured with TLS?

   • AIMAP on TCP 143
   • BIMAPS on TCP 993Correct
   • CPOP3 on TCP 110
   • DSMTP on TCP 25
   ✓ Correct answer: B

   Plain IMAP runs on TCP 143 without encryption. IMAPS encapsulates IMAP in TLS and uses TCP 993, protecting credentials and message content as clients retrieve mail from the server.

   Why the other options are wrong

   • AIMAP on TCP 143 is the unencrypted version of the protocol.
   • CPOP3 on TCP 110 is a different unencrypted mail-retrieval protocol.
   • DSMTP on TCP 25 sends mail between servers and is not for client retrieval.
10. Question 10Vulnerability Assessment and Risk Management

    An analyst is triaging two findings on internet-facing servers. Finding 1 has a CVSS base score of 7.5 but no patch and an exploit is being used in the wild; finding 2 has a CVSS base score of 8.1 on an isolated internal lab host with no network reachability. With limited time, which prioritization decision best reflects sound vulnerability management?

    • APrioritize finding 1 because real-world exploitation and exposure raise its actual risk despite the lower base scoreCorrect
    • BPrioritize finding 2 because its higher base score outweighs any real-world exposure difference
    • CTreat both findings as equal since their base scores are within one point of each other
    • DDefer both findings until a formal risk-acceptance sign-off is obtained from management
    ✓ Correct answer: A

    CVSS base score reflects intrinsic severity, but effective prioritization in the vulnerability management lifecycle also considers environmental and threat context: active exploitation, internet exposure, and asset value. Finding 1 is internet-facing with an exploit in the wild, so its real risk is higher even though its base score is slightly lower. Finding 2 is isolated and unreachable, lowering its practical urgency.

    Why the other options are wrong

    • BA higher base score on an unreachable lab host does not outrank an actively exploited, exposed flaw.
    • CClose base scores do not make the findings equal once exploitation and exposure are considered.
    • DAn actively exploited internet-facing flaw calls for action, not deferral pending sign-off.

Related Cisco resources

• Cisco CCST Cybersecurity (100-160) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCNP Security SCOR (350-701) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated
• Cisco CCNA Automation (200-901 CCNAAUTO) practice examRelated

Cisco CCST Cybersecurity (100-160) practice exam FAQ