Free Cisco 100-160 Practice Exam with Questions & Answers | Set: 2

TheCCST Cybersecurity Study Guidedescribes theDiamond Model of Intrusion Analysisas a framework to map the relationships between four core features of an intrusion:

Adversary– The threat actor or group conducting the attack.

Example: Ransomware Group

Capability– The tools, techniques, or malware the adversary uses.

Example: Phishing Email, Malware

Infrastructure– The physical or logical communication and delivery systems the adversary uses.

Example: Email Server, Domain Name

Victim– The target of the attack, such as systems, organizations, or individuals.

Example: Customer and Product Databases

"The Diamond Model helps analysts connect the attacker, the tools they use, the infrastructure supporting the attack, and the victim, providing a holistic view of the intrusion event."

(CCST Cybersecurity,Incident Handling, Threat Modeling section, Cisco Networking Academy)

TheCCST Cybersecurity Study Guideexplains that reconnaissance is the process of collecting information about a target before attempting exploitation.

"Passive reconnaissance is conducted without directly engaging with the target systems. Examples include reviewing public websites, examining HTML source code, querying public DNS records, and using social media to gather information. Since no packets are sent directly to the target system, it reduces the risk of detection."

(CCST Cybersecurity,Vulnerability Assessment and Risk Management, Reconnaissance Techniques section, Cisco Networking Academy)

Passive (A)is correct because all actions described — viewing public pages, searching online, and checking social media — involve no direct interaction that could alert the target.

Active (B)would involve direct probing, like port scans or vulnerability scans.

Offline (C)is not an official reconnaissance classification in this context.

Invasive (D)is a general term and not used as a standard reconnaissance category in CCST material.

TheCCST Cybersecurity Study Guide(based on the NIST Incident Response Lifecycle) outlines four phases:

Preparation–

"Develop and maintain an incident response capability to ensure organizational readiness. This includes tools, training, and security controls."

Detection and Analysis–

"Identify potential security incidents through monitoring, alerts, and analysis. Confirm whether suspicious activity is legitimate and assess the scope of the incident."

Containment, Eradication, and Recovery–

"Limit the impact of the incident, remove the threat, and restore systems to normal operation."

Post-Incident Activity–

"Document and review the incident to determine the root cause, evaluate response effectiveness, and implement measures to prevent recurrence."

(CCST Cybersecurity,Incident Handling, Incident Response Lifecycle section, Cisco Networking Academy)

TheCCST Cybersecurity Study Guideexplains thatWPA3is the most current and secure Wi-Fi Protected Access protocol, offering stronger encryption and better protection against brute-force attacks compared to earlier versions.

"WPA3 improves wireless security by using more robust encryption methods and protections against offline password guessing, making it the recommended protocol for securing modern Wi-Fi networks."

(CCST Cybersecurity,Basic Network Security Concepts, Wireless Security Protocols section, Cisco Networking Academy)

TheCCST Cybersecurity Study GuidehighlightsFileVaultas the macOS full-disk encryption tool.

"FileVault is macOS’s built-in full-disk encryption feature. It encrypts the contents of the entire startup disk to help prevent unauthorized access to the information stored on the drive, even if the device is lost or stolen."

(CCST Cybersecurity,Endpoint Security Concepts, Disk Encryption section, Cisco Networking Academy)

Ais correct: FileVault provides complete volume encryption.

B(Gatekeeper) controls app installation by verifying code signatures.

C(System Integrity Protection) protects system files from modification.

D(XProtect) is macOS’s built-in malware detection system.