Cisco 100-160 Online Practice Questions and Exam Preparation

Cisco 100-160 Online Questions & Answers

• Question 1:

  HOT SPOT

  For each statement, select True if it is a common motivation to commit cyber attacks or False if it is not.

  Note: You will receive partial credit for each correct selection.

  

  

  Explanation:

  The CCST Cybersecurity Study Guide outlines common motivations for cyberattacks, which include:

  Financial gain

  Revenge or personal grievance(e.g., disgruntled employees)

  Ideological or political purposes(hacktivism)

  Espionage and intelligence gathering

  "Cyberattack motivations range from financial and competitive advantage to personal vendettas and advancing political or social causes. Disgruntled insiders may misuse access privileges to harm an organization, while hacktivists target systems to promote social or political messages."

  (CCST Cybersecurity, Essential Security Principles , Threat Actor Motivations section, Cisco Networking Academy)

  Being disgruntled at work # common insider threat motivation ( True )

  Wanting to protect personal data # defensive action, not a reason to commit an attack ( False ) Wanting to advance a social agenda # hacktivist motivation ( True )

• Question 2:

  DRAG DROP

  You need to manage security risks at your company. In which order should you complete the actions?

  Move all the actions to the answer area and place them in the correct order.

  Select and Place:

  

  

  Explanation:

  The CCST Cybersecurity Study Guide outlines the standard risk management process in the following sequence:

  Identify the risks

  "Determine potential threats and vulnerabilities that could negatively impact organizational assets."

  Prioritize the risks

  "Assess each risk in terms of likelihood and potential impact to rank them for remediation."

  Implement a response

  "Apply the appropriate mitigation, transfer, acceptance, or avoidance strategy to address each prioritized risk."

  Monitor results

  "Continuously assess the effectiveness of implemented controls and make adjustments as needed."

  (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Risk Management Process section, Cisco Networking Academy)

• Question 3:

  DRAG DROP

  Move each NIST Incident Response Lifecycle phase from the list on the left to the correct description on the right.

  Note: You will receive partial credit for each correct answer.

  Select and Place:

  

  

  Explanation:

  The CCST Cybersecurity Study Guide (based on the NIST Incident Response Lifecycle) outlines four phases:

  Preparation

  "Develop and maintain an incident response capability to ensure organizational readiness. This includes tools, training, and security controls."

  Detection and Analysis

  "Identify potential security incidents through monitoring, alerts, and analysis. Confirm whether suspicious activity is legitimate and assess the scope of the incident."

  Containment, Eradication, and Recovery

  "Limit the impact of the incident, remove the threat, and restore systems to normal operation."

  Post-Incident Activity

  "Document and review the incident to determine the root cause, evaluate response effectiveness, and implement measures to prevent recurrence."

  (CCST Cybersecurity, Incident Handling , Incident Response Lifecycle section, Cisco Networking Academy)

• Question 4:

  DRAG DROP

  You need to diagram an intrusion event by using the Diamond Model.

  Move each event detail from the list on the left to the correct location in the diagram on the right.

  Note: You will receive partial credit for each correct response.

  Select and Place:

  

  

  Explanation:

  The CCST Cybersecurity Study Guide describes the Diamond Model of Intrusion Analysis as a framework to map the relationships between four core features of an intrusion:

  Adversary The threat actor or group conducting the attack. Example: Ransomware Group Capability

  The tools, techniques, or malware the adversary uses.

  Example: Phishing Email, Malware

  Infrastructure

  The physical or logical communication and delivery systems the adversary uses.

  Example: Email Server, Domain Name

  Victim

  The target of the attack, such as systems, organizations, or individuals.

  Example: Customer and Product Databases

  "The Diamond Model helps analysts connect the attacker, the tools they use, the infrastructure supporting the attack, and the victim, providing a holistic view of the intrusion event."

  (CCST Cybersecurity, Incident Handling , Threat Modeling section, Cisco Networking Academy)

• Question 5:

  DRAG DROP

  Move each scenario from the list on the left to the correct type of attacker on the right.

  Note: You will receive partial credit for each correct answer.

  Select and Place:

  

  

  Explanation:

  The CCST Cybersecurity Study Guide defines common attacker types:

  Cyber criminal

  "An individual or group engaging in illegal activities for financial gain, such as selling stolen data or running spam campaigns."

  State-sponsored attacker

  "Operates with the support or direction of a nation-state, often for espionage or political objectives."

  Insider threat

  "A person within the organization, such as an employee or contractor, who misuses access to cause harm or steal data."

  Hacktivist

  "Uses hacking techniques to promote political, social, or ideological causes."

  (CCST Cybersecurity, Essential Security Principles , Threat Actor Types section, Cisco Networking Academy)

• Question 6:

  Which encryption type is commonly used to secure WiFi networks?

  A. Data Encryption Standard (DES)
  B. Triple Data Encryption Algorithm (Triple DES)
  C. Advanced Encryption Algorithm (AES)
  D. RSA (Rivest-Shamir-Adleman)
  C. Advanced Encryption Algorithm (AES)

  ---

  explanation:

  The CCST Cybersecurity Study Guide specifies that AES (Advanced Encryption Standard) is the encryption method used in modern WiFi security protocols like WPA2 and WPA3.

  "WPA2 and WPA3 use the Advanced Encryption Standard (AES) for securing wireless traffic. AES provides strong symmetric encryption, replacing outdated methods like WEP and TKIP."

  (CCST Cybersecurity, Basic Network Security Concepts , Wireless Security section, Cisco Networking Academy)

  A (DES) is outdated and insecure.

  B (Triple DES) is older and slower, rarely used in WiFi.

  C is correct: AES is the industry standard for WiFi security.

  D (RSA) is asymmetric encryption used in key exchange, not bulk WiFi encryption.

• Question 7:

  Which two basic metrics should be taken into consideration when assigning a severity to a vulnerability during an assessment?(Choose 2.)

  A. The likelihood that an adversary can and will exploit the vulnerability
  B. The impacts that an exploit of the vulnerability will have on the organization
  C. The time involved in choosing replacement software to replace older systems
  D. The age of the hardware running the software that contains the vulnerability
  A. The likelihood that an adversary can and will exploit the vulnerability
  B. The impacts that an exploit of the vulnerability will have on the organization

  ---

  explanation:

  The CCST Cybersecurity course describes that risk scoring for vulnerabilities often involves likelihood and impact -- similar to the CVSS (Common Vulnerability Scoring System) model.

  "When prioritizing vulnerabilities, assess both the likelihood of exploitation and the potential impact to the organization. Likelihood measures how easy or probable it is for an adversary to exploit the weakness, while impact measures the consequences to confidentiality, integrity, and availability if exploitation occurs." (CCST Cybersecurity, Vulnerability Assessment and Risk Management , Risk Assessment and Prioritization section, Cisco Networking Academy) A is correct: Likelihood is a fundamental part of

  severity assessment.

  B is correct: Impact determines how damaging an exploit would be.

  C is incorrect: Time to choose replacement software is an operational consideration, not a severity metric.

  D is incorrect: Hardware age may influence performance but does not directly define vulnerability severity.

• Question 8:

  A SOC analyst notices repeated failed login attempts from a foreign IP address followed by a successful login to a privileged account. What is the most appropriate next step?

  A. Reset the affected user's password and investigate the scope of compromise.
  B. Block all foreign IP addresses from accessing the network.
  C. Run a full vulnerability scan of the corporate network.
  D. Ignore the event unless it happens again.
  A. Reset the affected user's password and investigate the scope of compromise.

  ---

  explanation:

  The CCST Cybersecurity course highlights that signs of brute-force attacks followed by successful access require immediate account security actions and an investigation to determine if other systems were accessed.

  "When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise."

  (CCST Cybersecurity, Incident Handling , Account Compromise Response section, Cisco Networking Academy)

• Question 9:

  How do threat actors launch ransomware attacks on organizations?

  A. They implant malware to collect data from the corporation's financial system.
  B. They deface an organization's public-facing website.
  C. They lock data and deny access to the data until they receive money.
  D. They secretly spy on employees and collect employees' personal information.
  C. They lock data and deny access to the data until they receive money.

  ---

  explanation:

  The CCST Cybersecurity course describes ransomware as a form of malicious software that encrypts or locks access to an organization's data, demanding payment for its release.

  "Ransomware is a type of malware that denies access to data by encrypting it and demands payment from the victim to restore access. Threat actors may deliver ransomware through phishing emails, malicious downloads, or exploiting vulnerabilities in exposed systems."

  (CCST Cybersecurity, Essential Security Principles , Malware Types and Threats section, Cisco Networking Academy)

  A describes spyware or information-stealing malware.

  B is website defacement, which is vandalism, not ransomware.

  C is correct: locking/encrypting data and demanding payment is the defining behavior of ransomware.

  D is more aligned with insider threat or espionage activities.

• Question 10:

  You work for a hospital that stores electronic protected health information (ePHI) in an online portal. Authorized employees can use their mobile devices to access patient ePHI.

  You need to ensure that employees' mobile devices comply with HIPAA regulations.

  Which safeguard should you develop and implement?

  A. An ownership policy for employees' mobile devices
  B. A contingency plan
  C. A policy that requires multi-factor authentication to use the mobile device
  D. A policy to govern how ePHI is removed from mobile devices
  D. A policy to govern how ePHI is removed from mobile devices

  ---

  explanation:

  The CCST Cybersecurity Study Guide notes that HIPAA (Health Insurance Portability and Accountability Act) requires that ePHI be protected both in storage and when devices are decommissioned or repurposed. This includes implementing data removal policies for mobile devices.

  "HIPAA requires procedures for the removal of electronic protected health information (ePHI) from devices before disposal, reuse, or reassignment."

  (CCST Cybersecurity, Essential Security Principles , Regulatory Compliance section, Cisco Networking Academy)