Cisco CCST 100-160 Cybersecurity Practice Exam

• A. Availability
• B. Confidentiality
• C. Accountability
• D. Integrity Correct answer

Option D, Integrity, is correct because the file's contents were altered without authorization even though the file stayed accessible. Availability is not violated because the file can still be read, and confidentiality is not violated because no unauthorized disclosure occurred. Accountability is not a CIA triad principle and does not describe this scenario.

• A. Installing additional user applications for employee convenience
• B. Disabling unnecessary services, closing unused ports, and applying secure configuration baselines Correct answer
• C. Encrypting all outbound network traffic by default
• D. Increasing the device's processing power to handle more network traffic

Option B is correct because hardening reduces a device's attack surface by disabling unnecessary services, closing unused ports, and applying secure configuration baselines. Increasing processing power and installing extra applications have nothing to do with security posture, and encrypting outbound traffic addresses confidentiality in transit, not the device's baseline configuration.

• A. Vishing
• B. Phishing Correct answer
• C. Tailgating
• D. Smishing

Option B, Phishing, is correct because it describes a fraudulent email impersonating a trusted source to trick the recipient into entering credentials on a fake site. Vishing and smishing are voice-call and SMS-based variants, not email, and tailgating is a physical-security technique of following someone through a secured door.

• A. Non-repudiation
• B. Availability Correct answer
• C. Confidentiality Correct answer
• D. Integrity Correct answer

Options C, D, and B are correct because confidentiality, integrity, and availability are the three foundational principles of the CIA triad. Non-repudiation is a related security concept but is not one of the three core CIA triad components.

• A. SYN, ACK, FIN-ACK
• B. SYN, SYN-ACK, ACK Correct answer
• C. SYN-ACK, SYN, RST
• D. ACK, SYN, FIN

Option B is correct because the three-way handshake begins with the client sending SYN, the server replying SYN-ACK, and the client finishing with ACK, which establishes sequence numbers in both directions before data flows. Option D lists flags in an order that never occurs in a real handshake, Option A ends the exchange instead of opening it, and Option C starts from the server side and includes RST, which tears a connection down rather than building one.

• A. Port 67
• B. Port 161
• C. Port 389
• D. Port 53 Correct answer

Option D is correct because DNS uses port 53 for both UDP and TCP by default. Port 67 is DHCP, port 161 is SNMP, and port 389 is LDAP, so none of those relate to name resolution.

• A. SYN flood Correct answer
• B. DHCP starvation
• C. ARP cache poisoning
• D. DNS amplification

Option A is correct because a SYN flood sends many SYN segments without completing the handshake, leaving half-open connections in SYN_RECEIVED until the table fills up. ARP cache poisoning and DHCP starvation target different resources entirely, and DNS amplification abuses DNS servers to flood a victim with responses rather than exhausting a TCP connection table.

• A. The DHCP server issues leases from a smaller-than-usual address pool
• B. A single MAC address suddenly appears bound to two different IP addresses in the ARP table Correct answer
• C. DNS queries begin resolving to shorter TTL values
• D. Unsolicited ARP replies are observed on the segment without a corresponding request Correct answer

Options B and D are correct because a single MAC address suddenly bound to two IP addresses and unsolicited ARP replies with no matching request are both classic signs that an attacker is injecting forged ARP entries. A smaller DHCP pool suggests starvation rather than spoofing, and shorter DNS TTLs are unrelated to Layer 2 address resolution attacks.

• A. Task Scheduler
• B. Windows Defender Correct answer
• C. BitLocker
• D. Group Policy Editor

Option B is correct because Windows Defender is the built-in antimalware engine that provides real-time scanning without any third-party install. Option C (BitLocker) encrypts drives rather than scanning for malware, and Options C and D are administrative and scheduling tools with no antivirus function.

• A. nslookup
• B. tcpdump
• C. chkdsk
• D. netstat Correct answer

Option D is correct because netstat lists active connections and listening ports on Windows. Option A (nslookup) resolves DNS names, Option B (tcpdump) is a packet capture tool not native to Windows, and Option C (chkdsk) checks disk integrity.

• A. chmod Correct answer
• B. umask
• C. chgrp
• D. chown

Option A is correct because chmod changes a file or directory's permission bits on Linux. Option D (chown) changes ownership, Option C (chgrp) changes group ownership, and Option B (umask) sets a default mask for new files rather than modifying existing permissions.

• A. Block unsolicited inbound connections to the device Correct answer
• B. Restrict which local applications may initiate outbound network connections Correct answer
• C. Encrypt the operating system's boot partition
• D. Automatically patch installed software

Options A and B are correct because a host-based firewall's core purposes are blocking unsolicited inbound connections and restricting which local applications can initiate outbound connections. Option C describes disk encryption and Option D describes patch management, neither of which a firewall performs.

• A. Passive reconnaissance Correct answer
• B. Vulnerability scanning
• C. Active reconnaissance
• D. Penetration testing

Option A is correct because passive reconnaissance gathers information from publicly available sources, like DNS records, job postings, or social media, without ever sending traffic to the target. Options A and B (active recon and penetration testing) involve direct interaction such as scanning or exploitation, and vulnerability scanning also actively probes systems rather than staying passive.

• A. ISACA
• B. NIST
• C. ISO
• D. MITRE Correct answer

Option D is correct because MITRE operates the CVE Program and assigns the standardized CVE identifiers used to catalog publicly known vulnerabilities. NIST maintains the related National Vulnerability Database, which enriches CVE entries with scoring, but does not assign the identifiers themselves; ISO and ISACA are standards and governance bodies unrelated to CVE assignment.

• A. TLP:GREEN
• B. TLP:CLEAR Correct answer
• C. TLP:AMBER
• D. TLP:RED

Option B is correct because TLP:CLEAR is the designation for information that can be shared freely without restriction. TLP:RED limits sharing to the immediate recipients only, TLP:AMBER restricts sharing to a defined group with a need to know, and TLP:GREEN allows community-wide sharing but not public disclosure.

• A. Sending TCP SYN packets to a range of ports to determine which are open Correct answer
• B. Searching WHOIS records for domain registration information
• C. Performing a banner grab against an open service to identify its version Correct answer
• D. Reviewing an organization's public job postings for hints about their technology stack

Options A and C are correct because both sending SYN packets and grabbing service banners require directly interacting with the target, which makes them active reconnaissance. Reviewing public job postings and searching WHOIS records both pull from publicly available sources without touching the target, making them passive techniques instead.

• A. Artifacts Correct answer
• B. Baselines
• C. Heuristics
• D. Signatures

Option A is correct because artifacts is the general forensic term for the pieces of digital evidence, such as log entries and memory dumps, gathered during an investigation. Signatures (Option D) refer to known malware or attack patterns, baselines (Option B) describe normal behavior for comparison, and heuristics (Option C) are detection techniques, not the evidence itself.

• A. 72 hours Correct answer
• B. 7 days
• C. 24 hours
• D. 30 days

Option A is correct because GDPR requires a data controller to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. The other timeframes are not the standard GDPR requirement and would either report too late or don't match any GDPR provision.

• A. Preparation Correct answer
• B. Procurement
• C. Provisioning
• D. Publication

Option A is correct because Preparation is one of the four phases in the NIST SP 800-61 incident response lifecycle, alongside Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Procurement, Provisioning, and Publication are not part of this framework.

• A. Issuing digital certificates for TLS encryption
• B. Orchestrating actions across multiple disconnected security tools Correct answer
• C. Executing automated playbooks in response to detected events Correct answer
• D. Physically replacing network switches

Options C and B are correct because a SOAR platform's core value lies in executing automated playbooks in response to detected events and orchestrating actions across multiple, otherwise disconnected security tools. Physically replacing network hardware and issuing TLS certificates are unrelated operational and PKI functions that a SOAR platform does not perform.