Cisco CCST Cybersecurity Practice Test

Answer choices

1. A. Block the threat-intelligence provider’s IP address, for the described technical objective and its associated operational control requirements, for review.
2. B. Assume every internal host is compromised without checking the affected product, as the recommended implementation across the complete governed service lifecycle.
3. C. Validate the affected gateways, prioritize their risk immediately, and apply vendor mitigation or remediation based on confirmed exposure, for the specified implementation requirement.
4. D. Wait for the next routine monthly scan because intelligence should not change priorities, within the documented operational, security, ownership, and validation requirements.

Wrong-answer review

• A. Block the threat-intelligence provider’s IP address, for the described technical objective and its associated operational control requirements, for review.: This choice misclassifies the evidence described in the stem. Threat intelligence becomes actionable when it is correlated with local assets and exposure to drive risk-based defensive action.
• B. Assume every internal host is compromised without checking the affected product, as the recommended implementation across the complete governed service lifecycle.: This would change a different control without addressing the decisive condition. Threat intelligence becomes actionable when it is correlated with local assets and exposure to drive risk-based defensive action.
• D. Wait for the next routine monthly scan because intelligence should not change priorities, within the documented operational, security, ownership, and validation requirements.: This would weaken least privilege or expand access unnecessarily. Threat intelligence becomes actionable when it is correlated with local assets and exposure to drive risk-based defensive action.

Answer choices

1. A. Key protection is inadequate; compromise of the folder can expose both ciphertext and the key needed to decrypt it.
2. B. The encrypted files cannot provide integrity because all encryption is one-way, for the described technical objective and its associated operational control requirements.
3. C. The files are too large for symmetric encryption, for the described technical objective and its associated operational control requirements, in practice.
4. D. The folder should use a nonstandard TCP port instead, for the described technical objective and its associated operational control requirements.

Answer choices

1. A. The server is definitely compromised because the URL was requested, for the described technical objective and its associated operational control requirements, as presented.
2. B. The requests indicate attempted or probing activity, but exploitation is not confirmed without corroborating evidence, for this decision.
3. C. The traffic is definitely benign because no process change was logged, as the proposed design for the complete governed operational workflow.
4. D. The web logs should be deleted because they are inconclusive, within the defined security and accountability boundaries.

Answer choices

1. A. The test passed because RTO is the only recovery metric, under the organization’s defined implementation and exception-management process.
2. B. The test failed only if users forgot passwords, for the described technical objective and its associated operational control requirements, as described.
3. C. Recovery time succeeded, but the recovery-point requirement failed and backup/replication strategy needs remediation.
4. D. RPO applies only to network devices, not application data, for the stated security, delivery, and accountability requirements.

Answer choices

1. A. The port must be moved into the dynamic range to become secure, for the required outcome.
2. B. TCP ports are globally unique to a single application, for the affected environment.
3. C. A firewall cannot evaluate source or destination addresses when ports are present, under the stated technical, operational, and governance constraints.
4. D. The control assumes port number equals application identity, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. Eradication, because untested contact lists and escalation authority directly determine whether malware is removed from compromised systems, for the stated scenario.
2. B. Recovery, because backup communication channels directly determine whether restored data meets recovery-point objectives, within the stated policy framework.
3. C. Attribution, because current phone numbers and escalation authority are the primary evidence used to identify a threat actor, as the proposed incident handling approach.
4. D. Preparation/readiness, because communication paths and escalation authority must be established and exercised before an incident, as the recommended implementation across the complete governed service lifecycle.

Answer choices

1. A. A denial-of-service attack that prevents the service from responding, as the proposed essential security principles approach.
2. B. An on-path/man-in-the-middle attack that intercepts and modifies traffic, within the described operational context.
3. C. A physical tailgating attack that bypasses a controlled facility entrance.
4. D. A password-spraying attack that tests a common password across accounts, when applied.

Answer choices

1. A. Verify the new inbound rule is actually required and scope it to the minimum protocols, ports, and sources necessary, for the required business outcome.
2. B. Disable the host firewall because the perimeter firewall already exists, as the primary implementation for the described business requirement.
3. C. Allow all inbound traffic so the application can discover peers, for the described technical objective and its associated operational control requirements, within the described context.
4. D. Rename the application executable without changing the rule, for the described technical objective and its associated operational control requirements, under the described endpoint security concepts criteria.

Answer choices

1. A. Enable WPA3-Personal with a strong unique passphrase, change the administrator credentials, disable unnecessary WPS, and keep firmware current.
2. B. Keep the default administrator password but hide the SSID, for the described technical objective and its associated operational control requirements, as the primary proposed approach.
3. C. Use open Wi-Fi and rely on the internet firewall, for the described technical objective and its associated operational control requirements, as proposed.
4. D. Enable WEP because older encryption is more compatible, for the described technical objective and its associated operational control requirements, for the stated requirement.

Answer choices

1. A. Preserve relevant evidence, document findings, and escalate through the approved path to personnel with the authority to contain the system, for this decision.
2. B. Take unauthorized containment action because speed always overrides role boundaries, for the described technical objective and its associated operational control requirements, within this design.
3. C. Post the evidence in a public chat room for faster advice, for the described technical objective and its associated operational control requirements.
4. D. Close the alert because the analyst lacks authority to act, as the recommended implementation across the complete governed service lifecycle.