Chapter 3 of 5 · Cisco CCST 100-160 Cybersecurity
Endpoint Security Concepts
Operating systems, endpoint tools, compliance, updates, logs and malware removal.
- 6topics
- 26 minfast track
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Operating System Security on Windows, macOS and LinuxLearn built in security features of Windows, macOS and Linux, host firewalls, command line basics, file permissions and how…5 min
- 2The netstat, nslookup and tcpdump ToolsLearn what netstat, nslookup and tcpdump show, how to read their output on an endpoint, and how each helps you spot suspicious…4 min
- 3Endpoint Policy, Inventory, Backups, Compliance and BYODLearn how asset and software inventory, program deployment, backups, PCI DSS, HIPAA, GDPR and BYOD controls help prove that…5 min
- 4Software and Hardware Updates and PatchingLearn why Windows Update, application updates, drivers and firmware patches matter, and how a safe patching process of test…4 min
- 5Interpreting System Logs and Spotting AnomaliesLearn to read Windows Event Viewer, audit, system and application logs and syslog, and to spot anomalies such as failed logins…4 min
- 6Malware Scanning, Scan Logs and RemediationLearn the steps of malware removal: signs of infection, scanning, reading scan logs, isolating the device and fixing the cause of…4 min
About this chapter
What this chapter covers
This chapter is about protecting the devices people actually use.
An endpoint is a laptop, desktop, phone or server that connects to the network. Attackers often reach a network through one weak endpoint, so each device needs to be hardened, kept up to date and watched.
The chapter covers the security features of Windows, macOS and Linux, tools for gathering facts, compliance with policy, updates, logs and malware clean up. It assumes no earlier experience.
How the topics fit together
The topics follow the life of an endpoint: set it up, check it, maintain it, watch it and repair it.
The pages connect like this:
- Operating system security covers the protections each system already has.
- Endpoint tools let you see connections, name lookups and packets.
- Policy and compliance make sure devices are known, backed up and managed.
- Updates and patching close known weaknesses.
- Logs show what happened, and malware removal deals with infections found.
Patching, inventory and logging support each other. You cannot patch what you have not listed, and you cannot investigate what was not logged.
How to use these pages
Each topic page has the same five sections, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams, tables and short examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions with short answers.
This chapter rewards hands on practice. Open Event Viewer on a Windows computer, run netstat -an, or look at file permissions with ls -l on Linux. Seeing real output makes the questions much easier.
Ready for more practice?
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.