Cisco 100-160 Online Practice Questions and Exam Preparation

Cisco 100-160 Online Questions & Answers

• Question 1:

  DRAG DROP

  Move each worm mitigation step from the list on the left to the correct description on the right.

  Note: You will receive partial credit for each correct answer.

  Select and Place:

  

  

  Explanation:

  The CCST Cybersecurity Study Guide outlines worm mitigation as a four-step process:

  Containment

  "Limit the spread of the worm by segmenting the network and restricting traffic from infected areas."

  Inoculation

  "Apply patches or updates to uninfected systems to prevent them from being compromised."

  Quarantine

  "Remove or block infected systems from the network to stop further infection."

  Treatment

  "Clean and patch infected systems to remove the worm and fix vulnerabilities."

  (CCST Cybersecurity, Incident Handling , Malware Mitigation Strategies section, Cisco Networking Academy)

• Question 2:

  A restaurant installs a second wireless router that only employees can use. Which statement describes how to securely configure the new router?

  A. Configure the new router to filter IP addresses.
  B. Configure the SSID with broadcast disabled.
  C. Configure a higher signal strength to allow coverage in the parking lot.
  D. Configure the SSID with the same SSID used by the customer router.
  B. Configure the SSID with broadcast disabled.

  ---

  The CCST Cybersecurity Study Guide explains that disabling SSID broadcast hides the network from casual scanning, adding a layer of obscurity. While not a complete security measure, when combined with WPA2 /WPA3 encryption and strong passwords, it can help protect private wireless networks, especially in environments with separate employee and guest access.

  "Disabling SSID broadcast can reduce the visibility of a wireless network, making it less likely to be detected by casual attackers. This should be combined with strong encryption and authentication."

  (CCST Cybersecurity, Basic Network Security Concepts , Wireless Security section, Cisco Networking Academy)

  A (IP filtering) provides limited protection and is harder to manage for employee devices.

  B is correct: Disabling SSID broadcast adds an extra layer of obscurity for the employee network.

  C would make the network easier to access from outside the premises, which is less secure.

  D would cause network conflicts and make segmentation impossible.

• Question 3:

  You are going to perform a penetration test on a company LAN. As part of your preparation, you access the company's websites, view webpage source code, and run internet searches to uncover domain information. You also use social media to gather details about the company and its employees.

  Which type of reconnaissance activities are you performing?

  A. Passive
  B. Active
  C. Offline
  D. Invasive
  A. Passive

  ---

  The CCST Cybersecurity Study Guide explains that reconnaissance is the process of collecting information about a target before attempting exploitation.

  "Passive reconnaissance is conducted without directly engaging with the target systems. Examples include reviewing public websites, examining HTML source code, querying public DNS records, and using social media to gather information. Since no packets are sent directly to the target system, it reduces the risk of detection."

  (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Reconnaissance Techniques section, Cisco Networking Academy)

  Passive (A)is correct because all actions described -- viewing public pages, searching online, and checking social media -- involve no direct interaction that could alert the target.

  Active (B)would involve direct probing, like port scans or vulnerability scans.

  Offline (C)is not an official reconnaissance classification in this context.

  Invasive (D)is a general term and not used as a standard reconnaissance category in CCST material.

• Question 4:

  Which log type would best help identify unauthorized configuration changes on a network switch?

  A. Authentication logs
  B. System event logs
  C. Configuration audit logs
  D. DNS query logs
  C. Configuration audit logs

  ---

  Configuration audit logs record administrative actions and device setting changes--matching CCST's description of change monitoring.

  Authentication logs (A) show login attempts but not configuration changes.

  DNS queries (D) track domain lookups.

  System logs (B) track device health, not configuration changes.

• Question 5:

  You are collecting data after a suspected intrusion on the local LAN.

  You need to capture incoming IP packets to a file for an investigator to analyze.

  Which two tools should you use?(Choose 2.)

  A. Wireshark
  B. tcpdump
  C. Nmap
  D. netstat
  A. Wireshark
  B. tcpdump

  ---

  The CCST Cybersecurity Study Guide specifies that both Wireshark and tcpdump are packet capture tools that can record network traffic to a file for later analysis.

  "Wireshark provides a graphical interface for packet capture and analysis. Tcpdump is a command-line tool that captures packets for detailed offline review."

  (CCST Cybersecurity, Incident Handling , Network Traffic Analysis section, Cisco Networking Academy)

  A is correct: Wireshark is widely used for packet capture and analysis.

  B is correct: tcpdump is a CLI-based packet capture tool.

  C (Nmap) is for network scanning, not packet capture.

  D (netstat) displays network connections and ports but does not capture packets.

• Question 6:

  A remote worker is visiting a branch office to attend face-to-face meetings. The worker tries to associate their company laptop with the branch wireless access point (WAP) but is unable to do so.

  What is a possible cause?

  A. The SSID is not broadcasting.
  B. The WAP is configured for MAC address filtering.
  C. The IP address of the laptop is not correct.
  D. The WAP is using open authentication.
  B. The WAP is configured for MAC address filtering.

  ---

  The CCST Cybersecurity material explains that MAC address filtering is a wireless security measure that allows only devices with approved hardware addresses to connect. If the laptop's MAC address is not on the allow list, the connection will be blocked even if the SSID is correct.

  "Wireless access points can be configured with MAC address filters to limit network access to authorized devices. If a device's MAC address is not on the permitted list, the connection will fail regardless of credentials."

  (CCST Cybersecurity, Basic Network Security Concepts , Wireless Security section, Cisco Networking Academy)

  A is unlikely because non-broadcast SSIDs can still be manually connected to.

  B is correct: MAC address filtering would block an unregistered device.

  C would cause IP issues after association, not prevent initial connection.

  D (open authentication) would allow connection, so it's not the cause here.

• Question 7:

  During an incident response, the security team needs to isolate a compromised server from the rest of the network but still allow forensic analysis. Which action should they take?

  A. Power off the server immediately.
  B. Disconnect the server from the network and connect it to an isolated forensic network.
  C. Delete suspicious files from the server.
  D. Reset all user passwords on the server.
  B. Disconnect the server from the network and connect it to an isolated forensic network.

  ---

  The CCST Cybersecurity course notes that isolation is a key part of the containment phase of incident response. The goal is to prevent the compromised system from communicating with the attacker or spreading malware, while preserving it for analysis.

  "Containment often involves removing an affected system from the production network and connecting it to a controlled forensic environment to preserve evidence and prevent further compromise."

  (CCST Cybersecurity, Incident Handling , Containment Procedures section, Cisco Networking Academy)

• Question 8:

  A security analyst notices that a workstation repeatedly attempts to connect to a command-and-control (C2) server using unusual outbound ports. Which type of malware behavior does this represent?

  A. Worm propagation
  B. Botnet activity
  C. Rootkit persistence
  D. Adware injection
  B. Botnet activity

  ---

  Botnets commonly maintain persistent outbound connections to remote C2 servers to receive instructions, exfiltrate data, or download additional payloads. This behavior aligns with CCST Cybersecurity concepts describing malware that "establishes remote control channels" and uses non-standard ports to avoid detection.

  Worm propagation (A) spreads laterally, not outbound C2 communication.

  Rootkits (C) hide processes rather than connect externally.

  Adware (D) generates ads, not C2 traffic.

• Question 9:

  You are asked to evaluate a suspicious file by executing it in a controlled virtual environment to observe its behavior. Which analysis method are you using?

  A. Static analysis
  B. Sandboxing
  C. Packet filtering
  D. Digital forensics
  B. Sandboxing

  ---

  CCST material defines sandboxing as executing unknown files in an isolated environment to analyze behavior safely.

  Static analysis (A) reviews code without execution.

  Packet filtering (C) inspects traffic, not files.

  Digital forensics (D) examines evidence but not necessarily via execution.

• Question 10:

  You are reviewing the Application log on a Windows computer. You see an event with an error-level message as shown.

  What can you determine about the application that generated the event message?

  

  A. The application is currently running much slower than expected.
  B. The application experienced a significant problem that caused it to fail.
  C. The application recovered from an event without loss of functionality.
  E. The application loaded and ran successfully without issues.
  B. The application experienced a significant problem that caused it to fail.

  ---

  In the CCST Cybersecurity course, Windows Event Viewer Error events in the Application log indicate a severe problem that caused an application or component to fail. This usually requires investigation or repair.

  "Error events indicate a significant problem such as a loss of functionality in an application or system component. Errors are often critical and need immediate attention."

  (CCST Cybersecurity, Incident Handling , Event Logging and Analysis section, Cisco Networking Academy)

  A is incorrect: Performance slowness would usually generate warnings, not errors.

  B is correct: An "Error" level in Event Viewer means the application failed in some way.

  C is incorrect: That describes an "Information" event, not an error.

  D is incorrect: That also corresponds to an "Information" event.