Cisco Certified Support Technician (CCST) Cybersecurity - Blueprint Practice Exam 1

1. A business purchases cyber insurance for residual exposure. Which risk treatment is most directly illustrated?
2. A control lowers incident likelihood while the business continues operating. Which treatment does this represent?
3. A firewall permits only required inbound services and denies unmatched connections. Which approach is illustrated?
4. A firewall rule allows source 10.8.4.0/24 to one database port. Which practice best maintains that rule?
5. A junior analyst confirms a suspected compromise beyond their assigned authority. What should they do next?
6. A locked server-room door is an example of which control category?
7. A message offers an urgent refund and asks for credentials through an unfamiliar link. What is most likely?
8. A mobile device may access company email only while encrypted and managed. Which control enforces this condition?
9. A new analyst receives an incident report containing personal information. How should it be shared?
10. A restored application starts successfully but has missing customer records. What must recovery validation include?
11. A scan discovers issues but does not attempt exploitation. How does this differ from penetration testing?
12. A scanner flags a supposedly vulnerable version, but a vendor backport patched it. What should the analyst do?
13. A sensor sees many failed connections from one source to sequential destination ports. What is a plausible explanation?
14. A service account has permissions far beyond its backup task. Which principle should correct this?
15. A stolen powered-off laptop holds sensitive files. Which protection most directly limits offline disk access?
16. A suspicious process persists after a user closes its visible window. Which capability assists investigation and containment?
17. A third-party supplier will process customer records. What should happen before granting access?
18. A USB drive found in a parking lot is offered to support for inspection. What should happen?
19. A user enters a password and a code from a hardware authenticator. Why can this strengthen authentication?
20. A weakness exists in a web application, but no attacker activity is observed. What best describes the weakness?
21. A workstation repeatedly connects to a known malicious domain. What is the best initial analyst action?
22. After removing malware, a team patches the exploited flaw before restoring service. Which objective is addressed?
23. An administrator hashes a downloaded installer and compares it with a trusted publisher's digest. What is being checked?
24. An administrator replaces HTTP with HTTPS for a login page. What protection is added?
25. An attacker alters account balances without authorization. Which security objective is most directly violated?
26. An attacker copies customer records without changing them. Which objective is most directly affected?
27. An attacker poisons name resolution to direct users to an imitation login page. Which mechanism is abused?
28. An employee uses hotel Wi-Fi to access an internal application. Which control protects the remote network connection?
29. An employee who reports a security error honestly is protected by management. What does this support?
30. An endpoint runs unsupported software with known exploitable flaws. What is the preferred durable action?
31. An exercise discusses a hypothetical breach without affecting production systems. What type of activity is this?
32. An IDS flags suspicious traffic but does not block it. Which statement is correct?
33. An owner chooses to retain a documented low risk within approved tolerance. What is this treatment?
34. Ransomware is spreading between endpoints. Which action most directly supports containment under the playbook?
35. Two flaws have similar severity scores. One is actively exploited on an Internet-facing system. Which should generally be prioritized?
36. What is the purpose of a post-incident lessons-learned review?
37. Why are tested backups still needed when endpoint antimalware is deployed?
38. Why should a guest WLAN be isolated from administrative systems?
39. Why should a responder record who handled an evidence disk and when?
40. Why should routine office work use a standard account rather than a local administrator?

Comments — 0