Step2Study

Cisco Certified Support Technician (CCST) Cybersecurity practice questions

226 free questions with answers and explanations.

Practice test
  1. 151.A large enterprise is concerned about the integrity and authenticity of software updates distributed to its internal servers. They need a mechanism to ensure that updates come from a trusted source and have not been tampered with during transit. Which cryptographic concept is critical for verifying both the origin and integrity of these software updates?Network Security
  2. 152.A network security team is designing a defense strategy against various types of attacks, including reconnaissance, denial-of-service, and malware propagation. They decide to implement a system that can both detect malicious activity and actively block or prevent it in real-time. Which technology best fits this description?Network Security
  3. 153.A company is implementing a security policy that requires all user accounts to be locked out after a specific number of failed login attempts within a short period. This measure aims to prevent attackers from repeatedly guessing passwords. Which type of attack is this policy primarily designed to mitigate?Network Security
  4. 154.An organization is reviewing its incident response capabilities. They have robust tools for threat detection and prevention, but lack a structured process for conducting post-incident reviews, documenting lessons learned, and updating policies and procedures. Which critical component of a comprehensive incident response program is currently underdeveloped?Incident Handling
  5. 155.A security auditor is reviewing a company's network security posture and identifies a critical vulnerability: the network does not enforce any policy-based access control, meaning any authenticated user can access any resource. The auditor recommends implementing a system that defines and enforces access rights based on user roles, attributes, and environmental conditions. Which security model is being recommended?Network Security
  6. 156.During a quantitative risk assessment, an organization determines that the Single Loss Expectancy (SLE) for a particular server outage is $5,000. If the Annualized Rate of Occurrence (ARO) for this type of outage is estimated to be 0.5 (meaning it occurs once every two years), what is the Annualized Loss Expectancy (ALE) for this server outage?Risk Management
  7. 157.A critical server hosting proprietary research data was found to be vulnerable to a new sophisticated ransomware variant. The organization's incident response team successfully contained the threat before any data was encrypted, and the vulnerability was patched. However, the organization incurred significant costs in terms of staff overtime, forensic analysis, and temporary disruption to research activities. This situation represents the realization of what aspect of risk?Risk Management
  8. 158.A cybersecurity consultant is advising a startup on its risk management strategy. The startup has limited resources and needs to prioritize its security efforts. The consultant recommends focusing on risks that have both a high likelihood of occurring and a high impact if they do occur, before addressing risks with lower likelihood or impact. This approach is fundamental to which risk management concept?Risk Management
  9. 159.An organization relies on a third-party vendor to host its critical customer database. The vendor recently experienced a significant data breach, exposing sensitive records. Although the organization had a service level agreement (SLA) in place that included specific security clauses and indemnification for data breaches, the organization's reputation was severely damaged, and customers lost trust. This scenario best illustrates the concept of:Risk Management
  10. 160.A security analyst is conducting a quantitative risk assessment for a critical web application. They determine that a successful denial-of-service (DoS) attack would cost approximately $50,000 in lost revenue and recovery efforts. Historical data suggests there is a 10% chance of such an attack occurring in a given year. What is the Annualized Loss Expectancy (ALE) for this specific risk?Risk Management
  11. 161.A small e-commerce startup is conducting its first cybersecurity risk assessment. They have identified that a data breach could lead to significant financial losses and reputational damage. However, due to limited resources, they decide to focus their initial efforts on implementing basic security controls like strong passwords and multi-factor authentication. Which risk management strategy are they primarily employing?Risk Management
  12. 162.A financial institution is performing a quantitative risk assessment for its online banking platform. They have determined that the Single Loss Expectancy (SLE) for a data breach event is $500,000. Historical data indicates that such an event is expected to occur once every five years. What is the Annualized Loss Expectancy (ALE) for this specific risk?Risk Management
  13. 163.An organization has implemented a new security information and event management (SIEM) system to aggregate and analyze security logs from across its network. The SIEM is configured to generate alerts for suspicious activities and is regularly reviewed by security analysts. This activity primarily falls under which phase of the risk management lifecycle?Risk Management
  14. 164.A small business is considering implementing a new customer relationship management (CRM) system. During the risk assessment, it's determined that a data breach could lead to significant financial losses and reputational damage. The business decides to purchase a cyber insurance policy to cover potential financial impacts from such a breach. Which risk mitigation strategy is being employed here?Risk Management
  15. 165.A security team is evaluating the risk of an insider threat stealing sensitive intellectual property. They estimate the probability of such an event occurring in a year is 0.01 (or 1%). The financial loss if this happens is estimated to be $10,000,000, and the reputational damage, though hard to quantify, is considered 'Catastrophic'. What component of the risk assessment is primarily being focused on when considering the 'Catastrophic' reputational damage?Risk Management
  16. 166.A company is performing a qualitative risk assessment for its new e-commerce platform. They identify a potential Distributed Denial of Service (DDoS) attack as a threat. They rate the likelihood of this attack as 'High' and the impact as 'Severe' based on historical data and expert opinion. What is the next logical step in their risk assessment process after determining these ratings?Risk Management
  17. 167.A financial services company is evaluating a new third-party cloud provider to host its critical customer data. Before signing the contract, the company requires the provider to undergo a SOC 2 Type II audit and maintain specific data encryption standards. What aspect of risk management is the financial services company primarily addressing by imposing these requirements?Risk Management
  18. 168.A company decides to outsource its entire IT infrastructure to a third-party cloud provider. As part of the contractual agreement, the cloud provider assumes full responsibility for the security of the underlying infrastructure, including patching, maintenance, and physical security. The company retains responsibility for securing its data and applications. From the perspective of the company, what risk management strategy is primarily being applied regarding the infrastructure security?Risk Management
  19. 169.An organization is conducting a comprehensive risk assessment. They have identified several high-risk vulnerabilities in their legacy systems. Due to budget constraints and the end-of-life status of these systems, a decision is made to leave them operational but isolated on a separate network segment with strict access controls, rather than replacing them entirely. This strategy is primarily an example of which risk mitigation technique?Risk Management
  20. 170.An organization relies heavily on a legacy software application for its core business operations. A recent security audit revealed several critical vulnerabilities in this application, which the vendor no longer supports. Replacing the application would be prohibitively expensive and disruptive. Despite significant efforts to implement compensating controls, some vulnerabilities remain. The organization's board decides to continue using the application, fully aware of the remaining risks. What risk management concept does this scenario best illustrate?Risk Management
  21. 171.A healthcare organization is implementing a new electronic health records (EHR) system. During the risk assessment, they identify that unauthorized access to patient data could lead to severe legal penalties under HIPAA regulations and significant damage to patient trust. They classify this risk as 'High' likelihood and 'High' impact. What concept are they using to categorize and understand the severity of this risk?Risk Management
  22. 172.A security auditor is reviewing an organization's risk management framework. The auditor notes that while the organization has identified numerous risks and implemented various controls, there is no formal process for regularly reviewing the effectiveness of these controls or for identifying new threats and vulnerabilities that may have emerged. Which key aspect of a robust risk management program is most critically lacking?Risk Management
  23. 173.An organization relies heavily on a specific proprietary software application for its core business operations. A recent security audit revealed a critical zero-day vulnerability in this application. The software vendor has acknowledged the vulnerability but has not yet released a patch, and no immediate workaround is available. The organization determines that decommissioning the application is not feasible due to business continuity requirements. What is the most appropriate immediate risk response strategy the organization is forced to take in this specific situation?Risk Management
  24. 174.A cybersecurity team is conducting a risk assessment and has identified a critical vulnerability in a widely used web server application. This vulnerability allows for remote code execution. The team has determined that the likelihood of an exploit occurring is 'High' and the impact of a successful exploit would be 'Severe'. Which of the following best describes the inherent risk of this vulnerability?Risk Management
  25. 175.A small logistics company relies heavily on its proprietary inventory management system, which runs on an aging server. A recent vulnerability scan identified several critical unpatched vulnerabilities on this server. The company's IT budget is severely constrained, and replacing the server or implementing a robust patch management solution for legacy systems is currently unaffordable. The company decides to continue operating the system as is, acknowledging the risks but implementing no new countermeasures. Which risk management strategy is being applied?Risk Management
  26. 176.A cybersecurity analyst is evaluating a new cloud-based application that stores sensitive customer data. The analyst identifies that the application uses a third-party authentication service. What is the primary risk management concept being applied when considering the potential vulnerabilities introduced by this third-party service?Risk Management
  27. 177.A new software development team has been formed within an organization. Due to tight deadlines, the team decides to use several open-source libraries without conducting thorough security vulnerability scans or dependency checks. This decision is consciously made, understanding the potential for introducing vulnerabilities, but accepting the risk to meet the project's timeline. Which risk response strategy does this scenario best describe?Risk Management
  28. 178.A government agency is performing a risk assessment for a new system that will store classified information. They identify a critical vulnerability that could lead to unauthorized access. Due to the sensitive nature of the data, the agency decides not to deploy the system until the vulnerability is fully remediated, even if it delays the project significantly. Which risk response strategy is being employed?Risk Management
  29. 179.A software development company is adopting a DevSecOps approach. As part of this, security scans are integrated directly into the continuous integration/continuous deployment (CI/CD) pipeline. Developers receive immediate feedback on security vulnerabilities in their code, allowing them to fix issues before deployment. This proactive measure is an example of which risk management strategy?Risk Management
  30. 180.A cloud service provider (CSP) offers various security features, including advanced threat detection, intrusion prevention systems, and data encryption for data at rest and in transit, as part of its standard service package. By using this CSP, a small business effectively shifts some of the responsibility for maintaining these security controls to the provider. This is an example of which risk management strategy?Risk Management
  31. 181.A company is conducting a risk assessment for its new payment processing system. They identify a potential threat where an attacker could exploit a zero-day vulnerability in the system's web interface to steal customer credit card data. The team estimates the likelihood of this occurring as 'Medium' and the impact as 'High'. What is the risk rating for this scenario using a simple qualitative risk matrix?Risk Management
  32. 182.A cybersecurity incident response team is reviewing a recent breach where sensitive customer data was exfiltrated. The team identifies that the breach occurred due to an unpatched vulnerability in a legacy web server, despite a patch being available for over six months. What type of risk was realized in this scenario?Risk Management
  33. 183.A financial institution is implementing a new online banking portal. They are particularly concerned about meeting regulatory compliance requirements, such as PCI DSS and GDPR, which mandate specific security controls for handling sensitive customer data. In the context of risk management, ensuring adherence to these regulations is primarily an example of addressing which type of risk?Risk Management
  34. 184.A healthcare provider is implementing a new electronic health record (EHR) system. They are particularly concerned about ensuring patient data privacy in accordance with HIPAA regulations. The organization's risk management team is focusing on identifying risks associated with non-compliance and potential legal penalties. What type of risk is the team primarily concerned with?Risk Management
  35. 185.A security analyst is investigating a compromised workstation. The investigation reveals that the attacker gained initial access by exploiting a vulnerability in an outdated web browser. The attacker then installed a backdoor. To prevent similar incidents, the organization needs to implement a continuous process to ensure all software, including operating systems and applications, are kept up-to-date with the latest security fixes. Which endpoint security best practice would address this need?Endpoint Security
  36. 186.A developer workstation is configured with multiple virtual machines (VMs) for testing different application versions. To minimize the attack surface, the security team recommends ensuring that each VM is isolated from the host OS and other VMs as much as possible, and that unnecessary services are disabled. This aligns with which endpoint security best practice?Endpoint Security
  37. 187.A managed security service provider (MSSP) is advising a client on improving endpoint security for their distributed workforce. The client uses various operating systems (Windows, macOS, Linux) and needs a solution that provides advanced threat detection, real-time visibility into endpoint activities, and automated response capabilities across all these platforms. Which technology best meets these requirements for comprehensive endpoint protection and response?Endpoint Security
  38. 188.A recent audit revealed that several company laptops, when taken off-site, are not consistently enforcing strong password policies or updating their antivirus definitions. Which endpoint security best practice is most directly violated by this finding?Endpoint Security
  39. 189.A security administrator is configuring a new laptop for a remote employee. The company policy requires that all data on the laptop's hard drive be protected in case the device is lost or stolen. Which endpoint security technology should the administrator implement to meet this requirement?Endpoint Security
  40. 190.A company is concerned about a new sophisticated malware strain that uses polymorphic code to evade traditional signature-based antivirus detection. The security team needs an endpoint security technology that can identify and block this type of evolving threat by analyzing its behavior rather than relying solely on known signatures. Which technology offers this capability?Endpoint Security
  41. 191.A company is implementing stringent security measures for its remote workforce. They want to ensure that all company-issued laptops, even when used off-network, are protected against unauthorized access to their operating systems and data in case of loss or theft. Which endpoint security best practice directly addresses this concern by making the data unreadable without proper authentication?Endpoint Security
  42. 192.A security team is implementing a host-based firewall policy for all corporate workstations. Which of the following rules, if incorrectly configured, would pose the GREATEST risk of inadvertently allowing malicious outbound connections while still permitting legitimate user activity?Endpoint Security
  43. 193.A security analyst receives an alert from an Endpoint Detection and Response (EDR) system indicating a suspicious process attempting to inject code into another running process on a critical server. This behavior is highly indicative of an advanced persistent threat (APT) attempting to escalate privileges or establish persistence. Which EDR capability is primarily responsible for detecting this type of low-level, in-memory attack technique?Endpoint Security
  44. 194.A company is transitioning to a Bring Your Own Device (BYOD) policy for its employees. They want to allow employees to use their personal smartphones and tablets for work-related tasks, but need to ensure that corporate applications and data accessed on these devices are secured and can be remotely wiped without affecting the employee's personal data. Which endpoint security technology is best suited for this specific challenge?Endpoint Security
  45. 195.A security team is implementing a new policy to restrict unauthorized devices from connecting to the corporate network. They want a solution that can automatically identify and control access for both wired and wireless devices based on their security posture before they are allowed to communicate with other internal resources. Which endpoint security technology best fits this requirement?Endpoint Security
  46. 196.An organization is concerned about insider threats and data exfiltration from endpoints. They want to prevent sensitive documents from being copied to USB drives, uploaded to unauthorized cloud storage, or sent via personal email accounts. Which endpoint security technology is best suited to address these specific concerns?Endpoint Security
  47. 197.A security analyst is investigating a compromised workstation that was recently isolated from the network. They discover that the attacker exploited a vulnerability in an unpatched operating system and then used a privilege escalation technique. Which of the following best describes the next immediate action the analyst should take to prevent further spread and re-infection?Endpoint Security
  48. 198.A security engineer is evaluating the effectiveness of the company's current endpoint security posture against zero-day exploits. They note that traditional signature-based antivirus frequently fails to detect these new threats. Which advanced detection technique would provide a better defense against polymorphic malware and unknown threats?Endpoint Security
  49. 199.A security administrator is configuring a new server. To minimize its attack surface, they are ensuring that only essential services and applications are installed and running, and all unnecessary ports are closed. This practice aligns with which security principle?Endpoint Security
  50. 200.A security audit identifies that several critical servers and workstations in the engineering department are running outdated operating systems with known vulnerabilities. The IT department cites application compatibility issues as a reason for not upgrading. Which endpoint security best practice is being neglected, and what is its primary purpose?Endpoint Security