Cisco Certified Support Technician (CCST) Cybersecurity

A rogue access point impersonates a legitimate SSID to lure devices into connecting--a threat described in the CCST wireless security section.
MAC spoofing (A) alters MAC addresses.
Deauthentication attacks (C) disconnect users but do not mimic SSIDs.
Password spraying (D) is unrelated to Wi-Fi impersonation.

The CCST Cybersecurity Study Guide states that after confirming a vulnerability is relevant and critical, the next step is to apply available patches or mitigations as soon as possible to reduce the attack surface.

"When a critical vulnerability is identified, remediation steps such as applying patches or configuration changes should be implemented immediately to prevent exploitation." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Vulnerability Remediation
section, Cisco Networking Academy)

According to CCST Cybersecurity material, adware causes unwanted advertisements, pop-ups, and browser redirections. Spyware (B) focuses on data collection, Trojans (A) disguise themselves as legitimate software, and ransomware (D) encrypts files.

The CCST Cybersecurity Study Guide states that vulnerability scanning is an automated process used to identify known security weaknesses in systems, software, and network devices. These scans compare system configurations and software versions against databases of known vulnerabilities, such as the Common Vulnerabilities and Exposures (CVE) list.

"A vulnerability scan is an automated test that checks systems and networks for known weaknesses by matching them against a database of vulnerabilities such as CVEs. This allows administrators to identify exploitable conditions before they are leveraged by attackers." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Vulnerability Scanning section, Cisco Networking Academy)
A is asset discovery, not vulnerability scanning.
B may be part of remediation planning but is not the primary purpose.
C is correct: Scans detect if systems have vulnerabilities associated with CVEs.
D describes SIEM (Security Information and Event Management) log correlation, not vulnerability scanning.

Application allowlisting restricts devices so only approved applications and OS components can execute-- matching CCST endpoint security guidance.
Backup policies (A) protect data, not execution control.
Password rotation (C) is unrelated.
Port scanning (D) identifies open ports, not allowed applications.

The CCST Cybersecurity Study Guide explains that a BYOD policy (Bring Your Own Device) should outline security requirements for personally owned devices connecting to the corporate network. Common requirements include:

Device encryptionfor stored sensitive corporate data.
Strong password or PINconfiguration for device access.
Restriction to secure and approved applicationsto reduce malware risk.

"BYOD policies typically mandate strong authentication, encryption of sensitive corporate data on personal devices, and installation of secure or approved applications. The goal is to protect corporate information while respecting personal ownership of the device." (CCST Cybersecurity, Endpoint Security Concepts , BYOD Security section, Cisco Networking Academy)
A is incorrect: BYOD policies do not require deletion of personal data unless wiping after separation.
B is not a common requirement due to privacy and technical limitations.
E (upgrading data plans) is unrelated to security.

The CCST Cybersecurity course states that an Intrusion Detection System (IDS) passively monitors network or system traffic and analyzes it against a database of known threat signatures or behavioral patterns.

"IDS devices inspect network traffic, compare it to known malicious signatures or anomalies, and generate alerts for suspicious activity without actively blocking traffic." (CCST Cybersecurity, Basic Network Security Concepts , IDS and IPS section, Cisco Networking Academy) Ais correct: IDS is passive and signature-based.
B(IPS) is active and can block traffic.
C(Proxy Server) handles requests between clients and servers.
D(Honeypot) is a decoy system to attract attackers.

The CCST Cybersecurity material describes that the first step after receiving a new CVE notification is to review its details --such as affected systems, severity, and exploitability--to determine if it is relevant to your organization.

"Upon learning of a new CVE, security teams should analyze the vulnerability description, affected products, and CVSS score to determine applicability and urgency of mitigation." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Vulnerability Prioritization section, Cisco Networking Academy)
A is correct: Confirming applicability avoids unnecessary remediation for irrelevant vulnerabilities.
B is done after confirming applicability.
C (disaster recovery plan) is unrelated to immediate CVE handling.
D (adding to firewall rules) is premature without confirming impact.

The CCST Cybersecurity Study Guide explains that reconnaissance is the process of collecting information about a target before attempting exploitation.

"Passive reconnaissance is conducted without directly engaging with the target systems. Examples include reviewing public websites, examining HTML source code, querying public DNS records, and using social media to gather information. Since no packets are sent directly to the target system, it reduces the risk of detection." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Reconnaissance Techniques
section, Cisco Networking Academy)
Passive (A)is correct because all actions described -- viewing public pages, searching online, and checking social media -- involve no direct interaction that could alert the target.
Active (B)would involve direct probing, like port scans or vulnerability scans.
Offline (C)is not an official reconnaissance classification in this context.
Invasive (D)is a general term and not used as a standard reconnaissance category in CCST material.

The CCST incident-handling model stresses that containment is the first priority.
Disabling the compromised account prevents further unauthorized access.
Password policy updates (B) and risk assessments (D) are long-term improvements, not immediate containment.
Shutting down the server (C) is not necessary unless damage is ongoing.