100-160 Exam Dumps and Practice Questions

The CCST Cybersecurity course notes that isolation is a key part of the containment phase of incident response. The goal is to prevent the compromised system from communicating with the attacker or spreading malware, while preserving it for analysis.

'Containment often involves removing an affected system from the production network and connecting it to a controlled forensic environment to preserve evidence and prevent further compromise.'

(CCST Cybersecurity, Incident Handling, Containment Procedures section, Cisco Networking Academy)

According to the CCST Cybersecurity course, Windows Event Viewer's Security logs record authentication-related events that can help identify password-guessing attempts (also known as brute force attacks).

'The Account logon failure event indicates that an authentication attempt has failed, which may suggest incorrect credentials were used. Multiple such events in a short time frame can indicate a brute-force attack. The Account lockout success event confirms that an account has been locked due to repeated failed logon attempts, which further supports the suspicion of password-guessing attacks.'

(CCST Cybersecurity, Incident Handling, Monitoring and Analyzing Security Events section, Cisco Networking Academy)

Object access failure relates to unauthorized attempts to open or modify files, not login attempts.

Account logon failure (B) shows failed login attempts due to invalid credentials.

Account lockout success (C) confirms that repeated login failures have triggered a lockout.

Account logoff success is a normal event and does not indicate malicious activity.

According to the CCST Cybersecurity Study Guide, firmware updates are a critical security maintenance task because vulnerabilities in firmware can be exploited by attackers to gain persistent control over hardware.

'Keeping firmware up to date is necessary to patch security vulnerabilities and weaknesses that could be exploited by threat actors. Vendors release firmware updates to correct security flaws, enhance stability, and ensure compatibility with updated security protocols.'

(CCST Cybersecurity, Endpoint Security Concepts, System and Firmware Maintenance section, Cisco Networking Academy)

A is partially true but not the primary security reason for updates.

B is incorrect because firmware is not part of the OS kernel; it's embedded in the hardware.

C is correct: patching vulnerabilities in firmware is essential for endpoint protection.

D may occur as a side benefit, but it's not the main reason from a cybersecurity perspective.

In the CCST Cybersecurity course, Windows Event Viewer Error events in the Application log indicate a severe problem that caused an application or component to fail. This usually requires investigation or repair.

'Error events indicate a significant problem such as a loss of functionality in an application or system component. Errors are often critical and need immediate attention.'

(CCST Cybersecurity, Incident Handling, Event Logging and Analysis section, Cisco Networking Academy)

A is incorrect: Performance slowness would usually generate warnings, not errors.

B is correct: An 'Error' level in Event Viewer means the application failed in some way.

C is incorrect: That describes an 'Information' event, not an error.

D is incorrect: That also corresponds to an 'Information' event.

The CCST Cybersecurity course describes ransomware as a form of malicious software that encrypts or locks access to an organization's data, demanding payment for its release.

'Ransomware is a type of malware that denies access to data by encrypting it and demands payment from the victim to restore access. Threat actors may deliver ransomware through phishing emails, malicious downloads, or exploiting vulnerabilities in exposed systems.'

(CCST Cybersecurity, Essential Security Principles, Malware Types and Threats section, Cisco Networking Academy)

A describes spyware or information-stealing malware.

B is website defacement, which is vandalism, not ransomware.

C is correct: locking/encrypting data and demanding payment is the defining behavior of ransomware.

D is more aligned with insider threat or espionage activities.