CCST Cybersecurity Practice Test

These questions are part of the practice quiz. Start practicing

• How often should patches be updated and tested?
• What are Yara Rules used for?
• Which type of cipher encrypts plaintext one byte or one bit at a time?
• NetBIOS is associated with which port range?
• Which description best matches the grep command?
• NMAP is an example of which category of security tools?
• Remote Desktop Protocol uses which port for typical connections?
• Which of the following is NOT a standard Windows event severity level?
• Which DNS record indicates the DNS servers assigned to a zone?
• Which of the following is NOT a private IPv4 address range?
• What is Tripwire in IT security?
• Which Cisco solution provides protection before, during, and after an attack?
• Why should an organization conform to a standard data governance framework?
• Cisco Web Security Appliance (WSA) is best described as?
• Which tool provides a console to view alerts generated by network security monitoring tools?
• What is DHCP's role in a network?
• Which activity is associated with monitoring and investigation in security operations?
• A loopback address is an IP address that indicates your own computer and is used to test TCP/IP configuration on the computer.
• Which is a capability area in the National Cybersecurity Workforce Framework?
• FERPA was enacted in which year?
• Which command can display the NetBIOS over TCP/IP connection data?
• Which logs are most likely to reveal the IP address and MAC address of devices on the local network?
• TCP port 80 is assigned to which protocol?
• TCP port 143 is used by which protocol?
• Which statement best describes a DDoS attack?
• Mean Time to Repair (MTTR) measures?
• Which term describes any device that controls or filters traffic going in or out of the network?
• What is a SIEM system used for?
• What type of system is used to contain an attacker to allow them to be monitored?
• What is Sguil used for?
• Which of the following is a private IPv4 address block within the 172 range?
• What is the purpose of vulnerability scanners?
• Which is the highest layer of the OSI model?
• When was COPPA passed by Congress?
• What is the default number of lines displayed by the tail command?
• Which protocol maps IP addresses to MAC addresses on a local network?
• Which phase involves documenting the incident, assessing impact, and identifying improvements to prevent recurrence?
• Which statement best describes the Computer Fraud and Abuse Act (CFAA) of 1986?
• Which type of security system provides real-time reporting and long-term analysis of security events in an enterprise?
• Which statement best describes End Point Detection and Response (EDR)?
• In the OSI model, which layer is responsible for end-to-end communication control?
• Which destination IPv4 address does a DHCPv4 client use to send the initial DHCP Discover packet when searching for a server?
• Which item is NOT typically included in an Endpoint Security Suite?
• Which online sandbox is described as offering interactive reporting and the ability to upload multiple malware samples?
• What is the IPv4 address 127.0.0.1 commonly known as?
• What is the most common goal of SEO poisoning?
• Which technology creates a security token that allows a user to log into a web application using credentials from a social media website?
• Which range defines Registered Ports?
• Which category includes policies, procedures, standards, user education, incident response, disaster recovery, compliance and physical security?
• Which threat type arises from the actions of people, not machines?
• In which document would a statement like 'Windows workstations must have the current security configuration template applied before deployment' most likely belong?
• What does SPF primarily verify?
• OpenVPN is used to provide encrypted tunneling for VPNs. Which of the following options reflects this role?
• COPPA protects privacy of children under what age?
• Which tool would you use to visualize the path taken by packets to a destination, showing each intermediate router (hop)?
• Which statement best describes PhishSigs as a resource?
• The HTTP status code 200 indicates what about the client request?
• Which technology creates a security token that allows a user to log in to a desired web application using credentials from a social media website?
• What class of IP addresses is used for multicast addressing?
• A password cracker is software that repeatedly makes guesses in order to crack the password.
• Which item is NOT a listed type of cyber threat?
• Which tool provides a list of open ports on network devices?
• Which protocol is commonly used to monitor and manage network devices and can reset passwords or change device baselines?
• What is the recommended network design to minimize risk from IoT devices with internet access?
• Which protocols operate on the Application layer of the TCP/IP model?
• Which tool is commonly used to crack wireless networks?
• Which statement best describes tracert/traceroute?
• Which criterion in Exploitability reflects the level of access required for a successful exploit?
• In the Security Onion architecture, which tool is known as a network traffic analysis tool?
• MS-SQL uses which port(s)?
• Which criterion expresses whether multiple authorities must be involved in an exploit?
• Which protocol is used by the Cisco Cyber Threat Defense Solution to collect information about the traffic that traverses the network?
• TCP port 443 is assigned to which protocol?
• What does PCI DSS stand for and what is its focus?
• Which DNS record maps one domain to another as an alias?
• Which KPI metric does SOAR use to measure the average time that it takes to stop and remediate a security incident?
• Which of the following statements correctly describes ipconfig on Windows?
• Which range is the loopback address range for IPv4?
• In the SOC three-tier model, which role is assigned to Tier 1?
• Which statement best describes the function of a protocol analyzer?
• Which command pair obtains a new IP address from a DHCP server?
• Which of the following is a threat source type?
• What is the Sarbanes-Oxley Act primarily concerned with?
• During which phase of the incident response process is evidence most likely gathered to support legal action?
• Which DNS record is used to publish a policy that combines SPF and DKIM results to handle unauthenticated emails?
• What is GFI LANguard?
• Which statement about ping options -6 and -4 is true?
• Which option correctly describes the arp command's purpose?
• What is a feature of the ANY.RUN malware sandbox?
• Which SDLC model is described as repeating four phases (requirements gathering, design, build, evaluation)?
• In the Diamond Model, which four elements constitute its framework?
• Which range is used for dynamic/private (ephemeral) ports?
• What is a canary trap used for?
• In network security, Sniffing refers to what activity?
• Which type of evidence is traditionally considered the strongest in investigations?
• DNS uses which port and transport protocols?
• Which DNS record would an email server query to locate the destination mail server for a domain?
• What does MTBF measure?
• In the Diamond Model, which element represents the means by which the attacker can inflict harm (tools, techniques, and capabilities)?
• Why does IoT technology pose a greater risk on a network?
• The three open ports 22, 443, and 1521 are commonly associated with which combination of services?
• What is an advantage for small organizations of adopting IMAP instead of POP?
• What is the purpose of output encoding in security coding techniques?
• Which term describes segments of unused network space that are monitored to detect unauthorized traffic?
• What type of system is designed to mislead attackers and collect information about attack methods?
• Which action would violate the CFAA?
• The ping utility is commonly used to test what aspects of a network connection?
• What parameter identifies the application when a client requests a service from a remote server?
• Which concept allows using the same credentials to access multiple networks or websites across different organizations, often via a single sign-on?
• What is the role of DNS?
• Cisco Advanced Malware Protection (AMP) provides which of the following?
• Which action should an organization take to improve wireless security?
• Which security mitigation technique involves rotating personnel roles every few months?
• Which option does NOT align with the defense-in-depth approach?
• Which is an on-path attack example?
• Email privacy risk: Including which type of information would most likely compromise patient privacy?
• Which SDLC model uses linear development concepts in an iterative, four-phase process?
• Which of the following is an example of a wireless cracking tool?
• Which of the following is a type of cyber threat?
• Which statement best describes netstat?
• Which command is commonly used to troubleshoot domain name servers and retrieve DNS resource records?
• What is the primary purpose of a packet analyzer?
• UDP port 69 is used by which protocol?
• Which tool is a packet sniffer?
• Which protocol operates at the Transport layer of the TCP/IP model?
• Which command is used to view the NetBIOS name cache?
• Which sequence correctly lists the OSI layers from the lowest to the highest?
• What does ping -6 do?
• What does DMARC rely on to verify emails?
• What is the default number of lines displayed by the head command?
• Which job would require verification that an alert represents a true security incident or a false positive?
• Defense-in-Depth/Layered Security is best described as?
• What is obfuscation in security coding?
• Which policy change would prevent the continued use of weak wireless encryption such as WEP?
• Which of the following is a network scanning tool?
• What is the Nmap utility used for?
• Which DNS record is commonly used to publish DKIM public keys?
• Knowingly accessing any computer used in or affecting interstate or foreign commerce without permission is a CFAA violation.
• Which item is a type of cyber threat involving errors in software causing vulnerabilities?
• The Electronic Communications Privacy Act (ECPA) aims to protect what?
• Which policy action is appropriate when an employee leaves the company?
• In exploitability metrics, which criterion expresses whether the attack requires the involvement of multiple authorities?
• In a penetration test, which phase focuses on gathering information about the target network or device?
• Which option names a firewall component associated with OpenBSD Packet Filter?
• TCP port 23 is used by:
• Which of the following is the IPv4 link-local address range?
• What does ipconfig /release do?
• Which term describes networks of compromised computers controlled by an attacker?
• What is IMPACT in cybersecurity?
• UDP port 67 is used by?
• Which tool is a password auditing and recovery application?
• IPv6 link-local addresses begin with which prefix?
• In the cybersecurity onion model, which is the first layer to protect?
• What is DKIM used for?
• What names are given to a database where all cryptocurrency transactions are recorded?
• Which protocol is used to send error messages and is commonly used with ping to test connectivity?
• Which address class corresponds to experimental addresses?
• During the deployment phase of an asset's lifecycle, what happens to the asset?
• The route command can
• In the SOC's three-tier model, who is Tier 3?
• What are the four steps of Incident Response?
• In incident response, Analysis is defined as
• Nbstat is a utility that
• Which remote access method is considered secure according to policy?
• Which option correctly identifies the two tools that can detect anomalous behavior, command and control traffic, and infected hosts when used together?
• What is a difference between symmetric and asymmetric encryption algorithms?
• Which statement correctly describes the difference between ping and traceroute?
• What does ARP stand for?
• Which statement best describes the function of a protocol analyzer?
• Which of the following is NOT one of the three detection tools mentioned for collecting alert data in Security Onion architecture?
• Which artifact is used to revoke certificates and inform entities of invalid certificates?
• Which statement best describes Snort?
• Which tool is used for real-time traffic analysis and can detect port scans, fingerprinting and buffer overflow attacks?
• Which Cisco product is described as an all-in-one web gateway and can block hidden malware from suspicious and legitimate websites?
• In defense in depth, which term represents the idea of providing multiple overlapping protections?
• Under CFAA, which access is criminal?
• TCP port 1701 is used by which VPN protocol?
• Which aspect includes network infrastructure, endpoints, servers, identity management, vulnerability management, monitoring and logging?
• Which of the following protocols use the Advanced Encryption Standard (AES)?
• What does a TXT DNS record typically store?
• Which of the following is an encryption tool?
• What does ping -4 do?
• Which security policy would address the process of updating AP configurations?
• What is the Cisco Email Security Appliance (ESA) designed to do?
• Which tool is commonly used to discover hosts and services on a network as part of a pentest?
• OpenVPN is listed as an encryption tool used for what purpose?
• Which TCP/IP layer is responsible for routing packets between networks?
• Which Exploitability criterion expresses the presence or absence of a user interaction requirement?
• What is a production honeypot primarily used for?
• Which of the following is NOT listed as a recovery-control example?
• What is Cuckoo Sandbox?
• Microsoft SQL Server typically listens on which port range for database connections?
• Which policy ensures that passwords are not reused across different applications?
• Which of the following is an example of a password cracking tool?
• Which tool can perform real-time traffic and port analysis, and can also detect port scans, fingerprinting and buffer overflow attacks?
• Which set of fields constitutes the five-tuple used in network monitoring?
• If a SOC has a goal of 99.999% uptime, approximately how many minutes of downtime per year is considered within its goal?
• Which DNS record type is commonly used to publish security-related information such as DKIM keys and DMARC policies?
• Which PKI component is responsible for issuing and managing digital certificates?
• Which components are typically included in Internet of Things deployments?
• Which three protocols are commonly used for email retrieval and sending?
• The cat command is used to
• Which policy change best prevents unauthorized escalation of privileges?
• In incident response, what is the primary goal of the Recovery phase?
• What are the two important components of a PKI used in network security?
• Which type of message is sent to all hosts on a remote network?
• Which technology enables accurate timestamping of network events by synchronizing time across devices?
• Which policy changes would help prevent passwords from being cracked within six hours?
• Which method of wireless authentication can take advantage of identity verification using a Radius server?
• What should be checked first when a laptop connects to a public Wi‑Fi network?
• Which TCP/IP application layer protocol is commonly used to transfer files between a client and a server?
• Which of the following is an example of a network scanning tool?
• Which statement best describes a Context Aware Application Firewall?
• Which statement about port 53 is true?
• In the SOC's three-tier model, who is Tier 2?
• Which term describes an attack that uses a network of compromised devices to flood a target's resources?
• Which tool is used to probe and test a firewall's robustness using specially crafted forged packets?
• What best defines the Internet of Things (IoT)?
• Which protocols operate at the Network Access layer of the TCP/IP model?
• In a penetration test, the initial phase focuses on documenting the target's current state to learn as much as possible.
• In incident response, Acquisition is best described as
• Which layer focuses on securing data as it moves across networks?
• Which of the following best describes an Endpoint Security Suite?
• What is the purpose of a DNS sinkhole in security?
• To protect intellectual property in development hosted on a public cloud, which practice is recommended?
• What is Nessus?
• Which Cisco service provides information about security incident detection rule sets for tools such as Snort, ClamAV, and SpamCop?
• In base metrics for exploitability, which description matches attack complexity?
• Which statement best describes a DNS attack?
• How many layers are in the OSI Reference Model?
• What does the -a option of ping do?
• Which firewall filters web content requests such as URLs and domain names?
• Which stage of the kill chain used by attackers focuses on the identification and selection of targets?
• Which IR phase involves extracting digital contents from a seized device so they may be analyzed?
• Which protocol runs over port 22 as a subsystem?
• What is L0phtcrack?
• What does CIPA require for federal funding?
• Which statement best defines an IP address spoofing attack?
• Which service commonly runs on port 22?
• Which tool is commonly used to scan systems for software vulnerabilities?
• Standards provide mandatory requirements for how policies are carried out. Which option best describes this concept?
• Which statement best describes camouflage in security coding techniques?
• A software company uses a public cloud service for hosting software development and deployment services. The company is concerned that software code in development might leak to competitors and result in the loss of intellectual property. Which security coding techniques can the company implement to address the concern?
• UDP ports 161/162 are used by which protocol?
• Using the Common Vulnerability Scoring System, which score indicates the most critical vulnerability?
• Which option correctly names the ARP command?
• Which debugging security tool can be used by black hats to reverse engineer binary files when writing exploits?
• Which threat category involves events like floods, earthquakes that disrupt operations?
• Which agency administers COPPA?
• NetFlow provides information that helps security teams analyze traffic patterns. Which description best captures NetFlow's purpose?
• Which type of firewall works at all layers of the OSI model?
• The Gramm-Leach-Bliley Act (GLBA) primarily governs privacy and protection of what type of information?
• Which of the following is a packet sniffing tool?
• A sandbox in cybersecurity is best described as...
• What is the correct order of the four steps of Incident Response?
• For what purpose would a network administrator use the Nmap tool?
• TCP ports 137-139 are used by which service?
• TCP port 21 is used by:
• Nessus is listed as which type of tool?
• Which of the following is a recognized threat source type?
• What term is used to record the order of evidence handling, by whom, and the nature of the handling?
• What is the best approach to prevent a compromised IoT device from maliciously accessing data and devices on a local network?
• Which of the following is an encryption tool?
• Which protocol uses UDP port 69 for simple file transfer without authentication?
• What is another term for the internet-facing port on a wireless router?
• Which statement best describes defense in depth?
• In FTK Imager, which mechanism is used to verify the integrity of the acquired data?
• Which protocol is used to access email on servers and keep content on the server, enabling access from multiple devices?
• NetFlow data is commonly used to collect and analyze traffic flow data. Which option describes this use?
• Which log type is described as a comma-delimited text file containing entries with fields such as ID, Date, Time, Description, IP Address, Host Name, and MAC Address?
• The default DHCP configuration on a home wireless router assigns which type of addresses to devices?
• Which organization ensures PCI DSS requirements are enforced for merchants and service providers?
• Which tool detects vulnerabilities on networks?
• A synchronized surge of traffic from multiple sources intended to overwhelm a target is best described as what?
• Which security coding technique ensures that data displayed to users will not execute unintended code in the browser?
• What is used by PKI entities to verify the validity of a digital certificate?
• Which type of security control focuses on people and processes rather than technology?
• What does input validation involve in security coding techniques?
• What is the main function of the Cisco Security Incident Response Team?
• What is the general purpose of encryption tools as described?
• What does ipconfig /renew do?
• Which term describes deliberate actions to damage an organization's operations?
• Which of the following is a packet crafting tool?
• Which of the following is a packet sniffing tool listed among the material's examples?
• In incident response, what is the primary goal of Seizure?
• FTK Imager is a forensic tool that can
• What policy change would ensure servers are updated with the latest patches at regular intervals?
• Which device is primarily used to enforce access control by filtering traffic at a network boundary?
• Which statement best describes the security onion analogy for defense in depth?
• Which threat category involves issues with physical components or devices?
• Which techniques can be used to enhance database security?
• What is a Denial-of-Service (DoS) attack?
• TCP port 25 is used by?
• Which of the following is the OpenBSD Packet Filter?
• What does MTTD stand for and measure?
• NetFlow is best described as what?
• What does the onion analogy in cybersecurity primarily illustrate?
• MTTC refers to the average time between the start and resolution of an incident (sometimes called MTTR for mean-time-to-resolve).
• Which firewall filters traffic based on the user, device, role, application, and threat profile?
• Which security coding technique is described as replacing sensitive data with realistic fictional data?
• Which act provides public access to federal agency records, subject to exemptions?
• What is the IPv4 multicast address range?
• UDP port 68 is used by which protocol's client service?
• What best describes a Man-in-the-Middle (MitM) attack?
• Which command is used to display the IP routing table on Windows hosts?
• Which item can be managed through Group Policy (GPO) in Windows environments?
• Which policy change would prevent unsecured remote access?
• Which secure media disposition method renders data unrecoverable to permit reuse within the organization?
• Which KPI metric does SOAR use to measure the time required to stop the spread of malware in the network?
• TCP port 20 is used by:
• At which layer of the TCP/IP model do devices such as switches operate, along with PPP and ARP?
• What is the primary use of a loopback address in testing network software?
• In incident response, Reporting is defined as
• What is hardening in cybersecurity?
• Which threat category involves stealing physical or data assets?
• What information is typically required to manually connect a mobile device to a secured wireless network?
• Which authentication protocol is well suited to untrusted networks and encrypts authentication traffic by default?
• A host is transmitting a broadcast, which hosts will receive it?
• Which technology protects the integrity of data in transit?
• The chmod command is used to
• CNAME records are primarily used to?
• COPPA took effect in April 2000.
• Which range defines Well Known Ports?
• What best describes a botnet?
• What is the National Vulnerability Database (NVD)?
• Which term is a defense in depth strategy?
• In exploitability metrics, which criterion describes whether multiple authorities must be involved in an exploit?
• Which phase of incident response involves containment, eradication, and recovery?
• Which IR phase results in the formal written documentation?
• What is Nslookup commonly used for?
• Which Act focuses on protecting consumer financial information and requires financial institutions to explain their privacy practices?
• Which practice is essential for preventing common web application attacks like SQL Injection and XSS by validating input and using whitelists?
• What is the effect of ipconfig /renew?
• Which phase focuses on preparation and prevention to minimize security incidents?
• What does ping -t do?
• Which threat category involves interruptions to power, water, or network connectivity?
• Which is an example of an on-path attack that can affect mobile devices?
• Which of the following is NOT a password cracking tool?
• Describe HIPAA.
• TCP port 110 is used by which protocol?
• In the five-tuple description, which elements are included?
• In the TCP/IP conceptual model, which layer is the lowest (closest to the physical medium)?
• Which of the following is primarily a database of phishing-related indicators?
• Which of the following is a technical control to support secure teleworker access to the corporate network?
• A cyberanalyst is looking for an open source malware analysis tool that can run locally on the network. Which tool would meet the needs of the cyberanalyst?
• The procedure of developing controls as vulnerabilities are discovered to prevent exploitation is known as
• The logger command is a Linux utility that
• TheHarvester is listed as which category of security tools?
• What does the MIME standard define?
• What is ping command used for?
• Which DNS record is used to specify the mail server for a domain?
• Which term describes a more complex decoy system used mainly by research, military, and government organizations?
• Which tool is described as an open source malware analysis tool that can run locally on the network?
• Rootkit detectors are best described as what?
• Which protocol uses TCP port 3389 and UDP port 3389 for remote desktop connections?
• What does an A record map?
• Who typically uses Registered Ports?