100-160 Cisco Certified Support Technician (CCST) Cybersecurity Exam Topics and Questions
These Cisco Certified Support Technician (CCST) Cybersecurity (100-160) exam topics are organized according to official exam domains to help candidates quickly verify coverage and focus on assessment rather than theory. Each domain is paired with topic-wise 100-160 sample questions that reflect how objectives are tested in the actual exam. This structure enables efficient review, targeted self-assessment, and rapid identification of weak areas when preparing for the Cisco Certified Support Technician (CCST) Cybersecurity certification exam.
Let's Practice Free Cisco 100-160 Questions Aligned with Official Exam Topics
This topic sets the floor for everything else on the exam. If your mental model of how threats, vulnerabilities, and controls relate to each other is fuzzy, every later topic will cost you marks. The examinable territory runs from foundational vocabulary through access control mechanics to encryption decisions. Gaps here tend to be invisible until exam day, because the terms feel familiar without being precise. – Threat landscape and foundational concepts The exam distinguishes between vulnerabilities, threats, exploits, and risks...
This topic sets the floor for everything else on the exam. If your mental model of how threats, vulnerabilities, and controls relate to each other is fuzzy, every later topic will cost you marks. The examinable territory runs from foundational vocabulary through access control mechanics to encryption decisions. Gaps here tend to be invisible until exam day, because the terms feel familiar without being precise.
– Threat landscape and foundational concepts
The exam distinguishes between vulnerabilities, threats, exploits, and risks as separate, precise terms. Knowing that a vulnerability is a weakness, a threat exploits it, and risk is the product of likelihood and impact is not enough: you need to apply those distinctions under scenario pressure. Attack vectors describe the path an attacker uses to reach a target, and hardening narrows those paths. Defense-in-depth layers controls so that no single failure is catastrophic. The CIA triad frames almost every control decision on this exam: when a scenario asks you to prioritise, the answer usually turns on which of confidentiality, integrity, or availability is most at stake. Attacker categories and their motivations matter because the exam uses them to set scenario context. The Cisco code of ethics is examinable and applies when a scenario puts professional obligation against personal interest.
– Common threats and social engineering
Malware families each have a characteristic behaviour: ransomware encrypts and ransoms, botnets coordinate distributed action, and so on. The exam tests whether you can match behaviour to category, not whether you can recite definitions. Denial-of-service scenarios ask you to identify the mechanism, not just the name. Social engineering is a rich source of exam items because the attacks are distinguished by channel and pretext: phishing arrives by email, vishing by voice, smishing by SMS, and spear phishing targets a specific individual with personalised content. Tailgating is physical. Man-in-the-middle attacks intercept traffic in transit. IoT vulnerabilities often come down to default credentials and unpatched firmware. Insider threats and Advanced Persistent Threats both involve sustained access, but their motivations and detection signatures differ, and the exam will ask you to tell them apart.
– Access management and AAA
Authentication, authorization, and accounting form a trio that the exam treats as distinct stages, not a single concept. RADIUS is the protocol that carries AAA in many network-access scenarios, and you should know what it does and where it sits in an architecture. Multifactor authentication combines something you know, something you have, and something you are: items test which combination qualifies as MFA, not just whether MFA is a good idea. Password policies are tested at the policy-design level: minimum length, complexity, history, and lockout thresholds each address a specific attack. Scenarios will ask which policy setting mitigates a given attack, so connect each setting to the threat it counters.
– Encryption methods and applications
Symmetric encryption uses one key; asymmetric uses a key pair. Hashing is one-way and produces a fixed-length digest used for integrity verification, not confidentiality. Certificates bind a public key to an identity, and PKI is the infrastructure that issues, manages, and revokes them. The exam distinguishes strong from weak algorithms: MD5 and DES are weak; AES and SHA-256 are strong. States of data determine which control applies: data in transit needs transport encryption such as TLS, data at rest needs storage encryption, and data in use is the hardest to protect. Protocols that use encryption, such as HTTPS, SSH, and SFTP, are tested by asking which protocol is appropriate for a given scenario. Choosing the wrong protocol because it sounds secure is a common trap.
How Essential Security Principles is tested
Items in this topic are almost always scenario-based. A situation is described and you must identify the correct term, the appropriate control, or the right protocol for the context. The vocabulary questions look easy but carry traps: the exam frequently presents two terms that candidates conflate, such as threat and risk, or authentication and authorization, and rewards the one who applies the precise meaning. Encryption items often hinge on the state of data or the weakness of a named algorithm. Social engineering items reward recognising the attack channel from the description rather than the name. Access management items tend to test whether you can match a policy setting to the attack it prevents. Candidates lose marks by applying general security knowledge instead of reading the scenario for the specific constraint it introduces. The CIA triad appears as a decision framework across multiple items, so practice resolving conflicts between the three properties rather than just defining them.
The ITExamsTopics practice test for the CCST Cybersecurity covers every sub-topic in this domain, giving you enough volume to spot whether your misses cluster around encryption, access management, or threat classification before you sit the real exam. A free demo is available in both PDF and practice-test formats.
The question below targets one of the distinctions this topic tests most often. Work through it before moving on.
Your supervisor tells you that you will participate in a CVSS assessment.
What will you be doing?
Where the first topic gave you the vocabulary, this one puts that vocabulary to work inside a network. The shift is from concepts to architecture: how addresses, protocols, and infrastructure components interact, and where each one introduces risk. Candidates who know security theory but lack networking grounding tend to lose marks here, because the exam embeds security decisions inside network-design scenarios that require you to read addressing and topology details accurately. – Protocol-level vulnerabilities TCP, UDP, HTTP, ARP, ICMP, DHCP,...
Where the first topic gave you the vocabulary, this one puts that vocabulary to work inside a network. The shift is from concepts to architecture: how addresses, protocols, and infrastructure components interact, and where each one introduces risk. Candidates who know security theory but lack networking grounding tend to lose marks here, because the exam embeds security decisions inside network-design scenarios that require you to read addressing and topology details accurately.
– Protocol-level vulnerabilities
TCP, UDP, HTTP, ARP, ICMP, DHCP, and DNS each have documented weaknesses that the exam treats as examinable facts. TCP's three-way handshake is the basis for SYN flood attacks. ARP has no authentication, which enables ARP spoofing and man-in-the-middle attacks on local segments. DNS is exploited through cache poisoning and hijacking. DHCP can be abused by rogue servers handing out false gateway addresses. ICMP is used in reconnaissance and certain denial-of-service variants. UDP's lack of a connection state makes it useful for amplification attacks. For each protocol, connect the structural weakness to the attack that exploits it: that is the level of precision the exam requires.
– Addressing and segmentation
IPv4 and IPv6 addresses are not just routing details: they carry security implications. Public addresses are reachable from the internet; private addresses behind NAT are not directly exposed, which is a security property, not just a routing convenience. MAC addresses operate at Layer 2 and are the basis for access controls on local networks, including MAC address filtering on wireless networks. CIDR notation appears in scenarios where you must determine whether two hosts are on the same subnet, which matters for understanding traffic flow and segmentation boundaries. Network segmentation limits the blast radius of a compromise: a flat network where every device can reach every other is a different risk profile from one divided into functional zones. Understanding where segmentation applies changes how you assess a given architecture.
– Network infrastructure and security architecture
A DMZ places publicly accessible services between two firewall boundaries, keeping them reachable from the internet without exposing the internal network. Virtualization and cloud introduce shared-resource risks that differ from physical infrastructure. A honeypot attracts attacker activity to a monitored decoy, generating threat intelligence. Proxy servers sit between clients and external destinations, providing filtering and anonymisation. IDS detects and alerts; IPS detects and blocks. The exam tests whether you can place each component correctly in an architecture and identify what it does and does not protect. Misplacing a component in a scenario, such as putting an IDS where an IPS is needed, or omitting a DMZ where one is warranted, is the primary trap in infrastructure items.
– Wireless security and secure access
Securing a small office or home office wireless network involves three practical decisions: which encryption standard to use, whether to hide or expose the SSID, and whether to apply MAC address filtering. WPA3 is the current strong standard; WEP is broken. SSID hiding provides minimal protection because the network is still discoverable. MAC address filtering adds a layer but is bypassable through spoofing. For secure access technologies, the exam covers CLI access controls, firewalls as traffic gatekeepers, VPNs for encrypted tunnels across untrusted networks, and NAC for enforcing endpoint compliance before granting access. Items in this area ask which technology fits the described requirement, so know what each one does and, equally, what it does not do.
How Basic Network Security Concepts is tested
This topic generates scenario items that embed a security question inside a network description. You may be given an IP address range and asked to determine exposure, or a protocol name and asked to identify its weakness. Items reward candidates who read the scenario detail rather than pattern-match on keywords. A scenario mentioning ARP is not automatically about ARP spoofing: read what is actually happening before selecting. Architecture items often present a partially described network and ask what is missing or misplaced. The trap is choosing a control that sounds appropriate in isolation but is wrong for the described topology. Wireless items frequently test the difference between what a control advertises and what it actually prevents. VPN and firewall items test placement and function, not brand knowledge. Candidates lose marks by over-generalising: knowing that firewalls filter traffic is not enough if you cannot say where in the architecture the firewall belongs and what traffic it should be filtering.
Working through the ITExamsTopics practice test under timed conditions is the fastest way to find out whether your networking knowledge holds up when it is embedded in a security scenario rather than asked directly. Both PDF and practice-test formats are included, with a free demo to start.
The question below places a network security decision in a specific architectural context. Apply what you know about placement and function.
What is the primary purpose of running a vulnerability scan on your network?
Network controls stop threats at the perimeter; this topic covers what happens at the device itself. Endpoints are where users operate, where credentials are stored, and where most malware executes. The exam tests your ability to assess, harden, and monitor individual systems across different operating systems. Candidates with a Windows-only background often lose marks on Linux and macOS items, and those who know hardening theory sometimes struggle with the practical tools this topic covers. – Operating system security across platforms...
Network controls stop threats at the perimeter; this topic covers what happens at the device itself. Endpoints are where users operate, where credentials are stored, and where most malware executes. The exam tests your ability to assess, harden, and monitor individual systems across different operating systems. Candidates with a Windows-only background often lose marks on Linux and macOS items, and those who know hardening theory sometimes struggle with the practical tools this topic covers.
– Operating system security across platforms
Windows, macOS, and Linux each have distinct security models, and the exam does not treat them as interchangeable. Windows Defender and host-based firewalls are Windows-specific controls with specific functions: Defender handles malware detection; the host-based firewall controls inbound and outbound traffic at the device level. The CLI and PowerShell are not just administrative tools: they are also attack surfaces and investigative instruments. File and directory permissions differ between Windows (ACL-based) and Linux/macOS (owner, group, other with read, write, execute). Privilege escalation is the technique by which an attacker or a misconfigured process gains more access than intended. The exam tests whether you can identify which permission model applies, which tool is appropriate for a given OS task, and which configuration creates a privilege escalation risk.
– Endpoint assessment tools
Three tools appear explicitly in this topic and each has a specific diagnostic use. Netstat shows active network connections and listening ports on an endpoint, making it useful for spotting unexpected outbound connections or services running where they should not be. Nslookup queries DNS and is used to verify name resolution and detect DNS anomalies. Tcpdump captures network traffic at the packet level, providing raw data for analysis when something suspicious is happening on or near an endpoint. The exam tests these tools at the level of what they show and when to use them, not at the level of command-line syntax memorisation. A scenario will describe a symptom and ask which tool would surface the relevant information.
– Compliance, inventory, and device management
Regulatory frameworks including PCI DSS, HIPAA, and GDPR each impose specific requirements on how data is handled at the endpoint level. The exam does not test the full text of each regulation but does test which framework applies to which data type: payment card data falls under PCI DSS, health information under HIPAA, and personal data of EU residents under GDPR. Hardware and software inventory underpin asset management: you cannot protect what you have not catalogued. Program deployment and data backup policies are controls that reduce exposure and recovery time. BYOD introduces a distinct set of challenges around device management, data encryption, application distribution, and configuration management, because the organisation does not fully control the device. Items in this area test whether you can match a compliance requirement or management challenge to the appropriate control.
– Updates, patching, and log analysis
Unpatched systems are one of the most consistently exploited conditions in real-world attacks, and the exam reflects that. Windows Update, application updates, device driver updates, and firmware updates each address a different layer of the stack, and missing any one of them leaves a gap. The exam distinguishes between these layers: a firmware vulnerability is not fixed by a Windows Update. Patching is a mitigation, not a guarantee, and the exam may test scenarios where patching is constrained by operational requirements. Log analysis is the investigative counterpart: Event Viewer, audit logs, system and application logs, and syslog each capture different event types. Identifying anomalies in logs requires knowing what normal looks like. Items here often present a log excerpt description and ask what it indicates, rewarding candidates who can connect an event pattern to a specific threat or misconfiguration.
How Endpoint Security Concepts is tested
Items in this topic tend to be practical rather than conceptual. A scenario describes a symptom, a system state, or a log observation, and you must identify the cause, the appropriate tool, or the correct control. Cross-platform items are a consistent source of difficulty: the exam will specify an operating system and the right answer depends on that specification. Candidates who default to Windows assumptions on Linux scenarios lose marks. Tool items reward knowing what each utility surfaces, not how to type its commands. Compliance items reward knowing which regulation governs which data category. Patch and update items reward understanding the layers of the software and hardware stack: a scenario that describes a firmware vulnerability is not answered by an application-layer control. Log analysis items reward recognising an anomaly pattern rather than reciting log formats. The broadest trap in this topic is treating all endpoints as equivalent: the exam consistently uses OS and context details to narrow the field to one defensible answer.
The ITExamsTopics question bank lets you check a specific weak area in this topic, such as log analysis or cross-platform permissions, without re-reading entire chapters. Access both the PDF and practice-test formats, and try the free demo before purchasing.
The question below draws on the practical, tool-level knowledge this topic tests. Read the scenario detail before selecting.
The previous topics covered controls applied to systems and networks. This topic shifts to the analytical layer: how you find weaknesses before attackers do, how you use external intelligence to stay current, and how you make defensible decisions when resources are limited. The exam tests structured thinking here, not just tool knowledge. Candidates who treat vulnerability management as a checklist activity and risk management as abstract theory both lose marks. – Vulnerability identification and reconnaissance Vulnerability management is a cycle:...
The previous topics covered controls applied to systems and networks. This topic shifts to the analytical layer: how you find weaknesses before attackers do, how you use external intelligence to stay current, and how you make defensible decisions when resources are limited. The exam tests structured thinking here, not just tool knowledge. Candidates who treat vulnerability management as a checklist activity and risk management as abstract theory both lose marks.
– Vulnerability identification and reconnaissance
Vulnerability management is a cycle: identify, prioritise, remediate, and verify. The exam tests each stage. Active reconnaissance involves direct interaction with a target, such as port scanning, which generates detectable traffic. Passive reconnaissance gathers information without touching the target, such as reviewing public records or monitoring traffic. The distinction matters because the scenario will specify constraints: a test that must not alert the target requires passive techniques. Port scanning maps open ports and running services; automation tools accelerate coverage but also generate noise that defenders can detect. The exam asks which technique fits the described scenario and what its limitations are, not which tool has the most features.
– Threat intelligence and documentation
Vulnerability databases, CVE identifiers, cybersecurity reports, and subscription intelligence feeds all serve the same function: they tell you what is known to be exploitable before your own systems are tested against it. CVEs provide a standardised identifier for a specific flaw in a specific product version, and the exam tests whether you can use that information to assess applicability to a given environment. The limitations of these sources matter as much as their uses: databases are retrospective, coverage is uneven, and zero-day vulnerabilities by definition have no CVE at the time of exploitation. Ad hoc and automated threat intelligence differ in timeliness and coverage. Documentation is examinable in its own right: the exam covers when and how to update documentation before, during, and after an incident, and how to secure and share it appropriately. Proactive documentation is a control, not an afterthought.
– Risk management decisions
A vulnerability is a weakness; risk combines that weakness with the likelihood of exploitation and the impact if it occurs. The exam tests this distinction precisely and will present scenarios where a high-severity vulnerability carries low risk because the asset is not exposed, or a low-severity vulnerability carries high risk because the asset is critical. Risks are ranked so that limited remediation resources go to the highest-priority items first. The four standard approaches to risk, accepting, avoiding, transferring, and mitigating, each apply to different combinations of likelihood and impact. Risk levels from low through extremely high provide a classification framework. Data classification affects risk: personal health information and payment card data carry regulatory consequences that amplify the risk of a breach. Security assessments of IT systems, covering information security, change management, computer operations, and information assurance, are the formal mechanism for measuring current risk posture.
– Disaster recovery and business continuity
Disaster recovery and business continuity planning exist because some incidents will succeed despite all preventive controls. The exam distinguishes between natural and human-caused disasters as different planning inputs: a hurricane and a ransomware attack both disrupt operations but require different response procedures. A disaster recovery plan focuses on restoring technology and systems; a business continuity plan keeps critical business functions running during and after a disruption. Backup strategy is a shared element of both: without tested backups, recovery is guesswork. Detective controls identify that a disaster has occurred; preventive controls reduce the likelihood or severity; corrective controls restore normal operations. The exam tests whether you can classify a control into the right category and whether you can identify what a DRP or BCP must contain to be functional.
How Vulnerability Assessment and Risk Management is tested
This topic generates items that require you to reason through a scenario rather than recall a fact. Risk items reward candidates who apply the vulnerability-versus-risk distinction correctly: a scenario that describes a known flaw in an isolated system is not the same risk as the same flaw in an internet-facing one. Threat intelligence items reward knowing what a CVE tells you and, just as importantly, what it does not tell you about exploitability in your specific environment. Reconnaissance items reward matching the technique to the constraint: active versus passive is a decision with consequences the exam will ask you to evaluate. Disaster recovery items reward distinguishing DRP from BCP and classifying controls correctly. Candidates lose marks by treating risk management as synonymous with vulnerability management, by over-relying on severity scores without considering context, and by confusing the three control categories in the disaster recovery section. Documentation items are often underestimated: treat them as seriously as the technical content.
Seeing how the ITExamsTopics question bank distributes items across vulnerability identification, risk reasoning, and disaster recovery planning lets you confirm your coverage is even rather than concentrated in one area. The PDF and practice-test formats are included in one purchase, with a free demo available.
The question below tests the kind of risk reasoning this topic rewards. Work through the scenario carefully before committing to an answer.
Every earlier topic feeds into this one. Knowing how threats work, how networks are structured, how endpoints behave, and how risk is assessed all become operational here, when something has actually gone wrong. The exam tests whether you can move from detection through analysis to a structured response, and whether you understand the legal and compliance obligations that shape how that response must be conducted. This is where candidates who have studied controls in isolation find the gaps in their...
Every earlier topic feeds into this one. Knowing how threats work, how networks are structured, how endpoints behave, and how risk is assessed all become operational here, when something has actually gone wrong. The exam tests whether you can move from detection through analysis to a structured response, and whether you understand the legal and compliance obligations that shape how that response must be conducted. This is where candidates who have studied controls in isolation find the gaps in their thinking.
– Monitoring, detection, and escalation
SIEM platforms aggregate log data from across an environment and correlate events to surface patterns that individual log sources would not reveal alone. SOAR extends that by automating response actions. The exam tests what each platform contributes and where each one's capability ends. Monitoring network data for security incidents means reading packet captures and log entries for indicators of compromise, not just waiting for an alert. Identifying suspicious events as they occur requires knowing what normal traffic and normal log behaviour look like for a given environment, because anomalies are defined against a baseline. Escalation is a decision: the exam tests the conditions that require escalation versus those that can be handled at the analyst level. Getting that threshold wrong in a scenario costs marks.
– Digital forensics and attack attribution
The Cyber Kill Chain, MITRE ATT&CK Matrix, and Diamond Model are three frameworks for describing and attributing attacker behaviour. The Kill Chain describes attack stages in sequence. ATT&CK catalogues specific tactics and techniques observed in real campaigns, organised so that defenders can map detections to adversary behaviour. The Diamond Model frames an intrusion around four elements: adversary, capability, infrastructure, and victim. Tactics, Techniques, and Procedures describe attacker behaviour at decreasing levels of abstraction: tactics are goals, techniques are methods, procedures are specific implementations. Sources of evidence, called artifacts, include files, logs, memory contents, and network captures. Evidence handling is examinable in detail: preserving digital evidence without altering it and maintaining a documented chain of custody are not bureaucratic formalities but legally consequential requirements that the exam tests directly.
– Compliance frameworks and reporting obligations
GDPR, HIPAA, PCI DSS, FERPA, and FISMA each impose specific requirements on how incidents are reported and to whom. The exam does not require you to memorise notification timelines in full, but it does test which framework applies to which type of data and organisation, and what the general obligation looks like. GDPR applies to personal data of EU residents and has mandatory breach notification to supervisory authorities. HIPAA applies to protected health information and requires notification to affected individuals and the Department of Health and Human Services. PCI DSS applies to payment card data. FERPA covers student education records. FISMA applies to federal information systems. Misidentifying the applicable framework in a scenario is a common error: read the data type and the organisational context before selecting.
– Incident response lifecycle
The NIST SP 800-61 incident response lifecycle is the structural backbone of this sub-topic. The stages, preparation, detection and analysis, containment, eradication and recovery, and post-incident activity, are examinable both in sequence and in terms of what each stage requires. Policy, plan, and procedure elements each operate at a different level of specificity: policy sets direction, plans operationalise it, and procedures provide step-by-step actions. The exam tests whether you can identify which stage a described activity belongs to, and whether you can recognise when a response team has skipped or reversed a stage. Items reward containing before eradicating, and eradicating before recovering, because doing things out of order risks reinfection or evidence loss. Post-incident activity, including lessons learned, is part of the lifecycle and is tested as a formal stage, not an optional follow-up.
How Incident Handling is tested
Items in this topic are scenario-heavy and often sequential: a situation is described at one point in an incident and you must identify what should happen next, or what went wrong in the described response. Lifecycle items reward knowing the NIST SP 800-61 stages and their order well enough to spot when a described response deviates from it. Framework items reward matching data type and organisation type to the applicable compliance obligation. Attribution items reward distinguishing between the Kill Chain, ATT&CK, and Diamond Model by what each one is used for, not just by name. Evidence handling items reward the procedurally correct action when digital evidence must be preserved: the temptation to act quickly is the trap, because actions that alter evidence undermine chain of custody. SIEM and SOAR items reward understanding the boundary between detection and automated response. Candidates lose marks by applying the right control at the wrong lifecycle stage, and by confusing which compliance framework governs the data type described in the scenario.
The ITExamsTopics practice test lets you experience the item style for this topic under timed conditions before the real exam, so the scenario format is not unfamiliar when it counts. One purchase covers both the PDF and practice-test formats, and a free demo is available.
The question below presents an incident scenario and asks you to apply the response knowledge this topic covers. Read the sequence of events carefully.
Ready to Start Practicing?
Access all questions and start your exam preparation journey
Upgrade to Full 100-160 Exam Questions 🚀
