Free 100-160 Exam Dumps Preview

The CCST Cybersecurity Study Guide explains that SOAR (Security Orchestration, Automation, and Response) platforms integrate data from multiple tools and sources, support case management, and automate security workflows for faster incident response.

"SOAR solutions provide orchestration, automation, and response capabilities. They collect security data from multiple systems, enable analysts to manage incidents, and automate repetitive tasks in the response process." (CCST Cybersecurity, Incident Handling , Security Automation Tools section, Cisco Networking Academy)
A (SIEM) collects and correlates security logs but lacks full orchestration and automated response capabilities.
B is correct: SOAR adds orchestration, case management, and automated incident response.
C (NextGen IPS) focuses on intrusion prevention, not orchestration.
D (Snort) is an open-source intrusion detection/prevention tool, not an orchestration platform.

The CCST Cybersecurity Study Guide explains that an insider threat is any threat to an organization that comes from people within the organization--employees, contractors, or business partners--who have inside information concerning the organization's security practices, data, and systems. Insider threats may be intentional or unintentional.

"An insider threat can be malicious or accidental. Employees may unintentionally cause data breaches by mishandling sensitive information, such as sending it to the wrong recipient." (CCST Cybersecurity, Essential Security Principles , Threat Actor Types section, Cisco Networking
Academy)
A (Logic bomb) is malicious code triggered by conditions.
B (Malware) is malicious software, unrelated to accidental email leaks.
C (Phishing) is an external social engineering attack.
D is correct: This is an unintentional insider threat .

The CCST Cybersecurity Study Guide highlights FileVault as the macOS full-disk encryption tool.

"FileVault is macOS's built-in full-disk encryption feature. It encrypts the contents of the entire startup disk to help prevent unauthorized access to the information stored on the drive, even if the device is lost or stolen." (CCST Cybersecurity, Endpoint Security Concepts , Disk Encryption section, Cisco Networking Academy)
Ais correct: FileVault provides complete volume encryption.
B(Gatekeeper) controls app installation by verifying code signatures.
C(System Integrity Protection) protects system files from modification.
D(XProtect) is macOS's built-in malware detection system.

The CCST framework emphasizes least privilege as the principle of limiting access to only what is necessary for a user's role.
Defense in depth (A) refers to layered security.
Segmentation (C) divides networks but does not specify privileges.
Zero trust (D) involves continuous verification, not role-restricted access.

The CCST Cybersecurity Study Guide identifies SYN flood attacks as a type of Denial of Service (DoS) attack that exploits the TCP three-way handshake. Attackers send many SYN requests without completing the handshake, leaving the server with numerous half-open connections and exhausting resources.

"A TCP SYN flood attack overwhelms a target server by initiating a high volume of TCP connections but never completing the handshake, resulting in numerous half-open connections that consume system resources and can render the service unavailable." (CCST Cybersecurity, Incident Handling , Denial-of-Service Attacks section, Cisco Networking Academy)
A is correct: The proper action is to stop the SYN flood, often using firewalls, intrusion prevention systems, or SYN cookies.
B (switching to HTTPS) does not address the flooding issue.
C is incorrect because the excessive number of half-open connections indicates an attack, not normal operation.
D (flushing DNS cache) is unrelated to this type of attack.

In the CCST Cybersecurity course, Windows Event Viewer Error events in the Application log indicate a severe problem that caused an application or component to fail. This usually requires investigation or repair.

"Error events indicate a significant problem such as a loss of functionality in an application or system component. Errors are often critical and need immediate attention." (CCST Cybersecurity, Incident Handling , Event Logging and Analysis section, Cisco Networking Academy)
A is incorrect: Performance slowness would usually generate warnings, not errors.
B is correct: An "Error" level in Event Viewer means the application failed in some way.
C is incorrect: That describes an "Information" event, not an error.
D is incorrect: That also corresponds to an "Information" event.

The CCST Cybersecurity material describes that the first step after receiving a new CVE notification is to review its details --such as affected systems, severity, and exploitability--to determine if it is relevant to your organization.

"Upon learning of a new CVE, security teams should analyze the vulnerability description, affected products, and CVSS score to determine applicability and urgency of mitigation." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Vulnerability Prioritization section, Cisco Networking Academy)
A is correct: Confirming applicability avoids unnecessary remediation for irrelevant vulnerabilities.
B is done after confirming applicability.
C (disaster recovery plan) is unrelated to immediate CVE handling.
D (adding to firewall rules) is premature without confirming impact.

The CCST Cybersecurity course highlights that signs of brute-force attacks followed by successful access require immediate account security actions and an investigation to determine if other systems were accessed.

"When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise." (CCST Cybersecurity, Incident Handling , Account Compromise Response section, Cisco Networking
Academy)

The CCST Cybersecurity Study Guide outlines worm mitigation as a four-step process:

Containment
"Limit the spread of the worm by segmenting the network and restricting traffic from infected areas."

Inoculation
"Apply patches or updates to uninfected systems to prevent them from being compromised."

Quarantine
"Remove or block infected systems from the network to stop further infection."

Treatment
"Clean and patch infected systems to remove the worm and fix vulnerabilities." (CCST Cybersecurity, Incident Handling , Malware Mitigation Strategies section, Cisco Networking
Academy)

The CCST Cybersecurity Study Guide states that after confirming a vulnerability is relevant and critical, the next step is to apply available patches or mitigations as soon as possible to reduce the attack surface.

"When a critical vulnerability is identified, remediation steps such as applying patches or configuration changes should be implemented immediately to prevent exploitation." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Vulnerability Remediation
section, Cisco Networking Academy)