The Cisco Certified Support Technician (CCST) Cybersecurity (100-160)

The CCST Cybersecurity course notes that isolation is a key part of the containment phase of incident response. The goal is to prevent the compromised system from communicating with the attacker or spreading malware, while preserving it for analysis.

"Containment often involves removing an affected system from the production network and connecting it to a controlled forensic environment to preserve evidence and prevent further compromise."

(CCST Cybersecurity, Incident Handling , Containment Procedures section, Cisco Networking Academy)

The CCST Cybersecurity Study Guide explains that HTTP (port 80) transmits data in cleartext, making it susceptible to interception. Even if data is stored securely in an encrypted database, sensitive information can be compromised during transmission if HTTPS (port 443) is not used.

"When HTTP is used instead of HTTPS, all form inputs and transmitted data are sent in plaintext over the network, where they can be intercepted by attackers."

(CCST Cybersecurity, Basic Network Security Concepts , Secure Protocols section, Cisco Networking Academy)

The CCST Cybersecurity Study Guide notes that HIPAA (Health Insurance Portability and Accountability Act) requires that ePHI be protected both in storage and when devices are decommissioned or repurposed. This includes implementing data removal policies for mobile devices.

"HIPAA requires procedures for the removal of electronic protected health information (ePHI) from devices before disposal, reuse, or reassignment."

(CCST Cybersecurity, Essential Security Principles , Regulatory Compliance section, Cisco Networking Academy)

The CCST Cybersecurity material states that a Virtual Private Network (VPN) provides secure communication over an untrusted network, typically by ensuring:

Authentication → verifying the identity of the user/device

Confidentiality → encrypting the data so it cannot be read by unauthorized parties

Integrity → ensuring that transmitted data has not been altered in transit

"VPNs secure remote access by authenticating users, encrypting data for confidentiality, and ensuring integrity through cryptographic checks."

(CCST Cybersecurity, Basic Network Security Concepts , VPNs section, Cisco Networking Academy)

A is incorrect: WAN management is a network administration function, not a VPN feature.

B is incorrect: Authorization is related but not a primary VPN security function.

C is correct: Integrity is preserved through cryptographic hashing.

D is correct: Authentication verifies user identity.

E is correct: Confidentiality is provided via encryption.

F is incorrect: Password management is separate from VPN functions.

The CCST Cybersecurity course describes that risk scoring for vulnerabilities often involves likelihood and impact — similar to the CVSS (Common Vulnerability Scoring System) model.

"When prioritizing vulnerabilities, assess both the likelihood of exploitation and the potential impact to the organization. Likelihood measures how easy or probable it is for an adversary to exploit the weakness, while impact measures the consequences to confidentiality, integrity, and availability if exploitation occurs."

(CCST Cybersecurity, Vulnerability Assessment and Risk Management , Risk Assessment and Prioritization section, Cisco Networking Academy)

A is correct: Likelihood is a fundamental part of severity assessment.

B is correct: Impact determines how damaging an exploit would be.

C is incorrect: Time to choose replacement software is an operational consideration, not a severity metric.

D is incorrect: Hardware age may influence performance but does not directly define vulnerability severity.

The CCST Cybersecurity course highlights that signs of brute-force attacks followed by successful access require immediate account security actions and an investigation to determine if other systems were accessed.

"When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise."

(CCST Cybersecurity, Incident Handling , Account Compromise Response section, Cisco Networking Academy)

The CCST Cybersecurity Study Guide states that Access Control Lists (ACLs) can be used to filter traffic based on IP addresses and block packets that appear to originate from the internal network but arrive from external interfaces (IP spoofing).

"ACLs can prevent spoofing by dropping traffic from external sources that claim to have an internal source address. Configuring ACLs on the perimeter firewall or router is a common countermeasure for IP spoofing."

(CCST Cybersecurity, Basic Network Security Concepts , ACLs and Traffic Filtering section, Cisco Networking Academy)

A (NAT rule) changes IP addresses but does not inherently prevent spoofing.

B (ACL) is correct because it can enforce anti-spoofing filters.

C (host file) only affects name resolution locally.

D (DNS record) is for domain mapping, not spoofing prevention.

The CCST Cybersecurity Study Guide explains that an insider threat is any threat to an organization that comes from people within the organization—employees, contractors, or business partners—who have inside information concerning the organization's security practices, data, and systems. Insider threats may be intentional or unintentional.

"An insider threat can be malicious or accidental. Employees may unintentionally cause data breaches by mishandling sensitive information, such as sending it to the wrong recipient."

(CCST Cybersecurity, Essential Security Principles , Threat Actor Types section, Cisco Networking Academy)

A (Logic bomb) is malicious code triggered by conditions.

B (Malware) is malicious software, unrelated to accidental email leaks.

C (Phishing) is an external social engineering attack.

D is correct: This is an unintentional insider threat .

The CCST Cybersecurity Study Guide explains that SOAR (Security Orchestration, Automation, and Response) platforms integrate data from multiple tools and sources, support case management, and automate security workflows for faster incident response.

"SOAR solutions provide orchestration, automation, and response capabilities. They collect security data from multiple systems, enable analysts to manage incidents, and automate repetitive tasks in the response process."

(CCST Cybersecurity, Incident Handling , Security Automation Tools section, Cisco Networking Academy)

A (SIEM) collects and correlates security logs but lacks full orchestration and automated response capabilities.

B is correct: SOAR adds orchestration, case management, and automated incident response.

C (NextGen IPS) focuses on intrusion prevention, not orchestration.

D (Snort) is an open-source intrusion detection/prevention tool, not an orchestration platform.