Cisco 100-160 - Cisco Certified Support Technician (CCST) Cybersecurity

TheCCST Cybersecurity Study Guidedescribes theDiamond Model of Intrusion Analysisas a framework to map the relationships between four core features of an intrusion:

Adversary– The threat actor or group conducting the attack.

Example: Ransomware Group

Capability– The tools, techniques, or malware the adversary uses.

Example: Phishing Email, Malware

Infrastructure– The physical or logical communication and delivery systems the adversary uses.

Example: Email Server, Domain Name

Victim– The target of the attack, such as systems, organizations, or individuals.

Example: Customer and Product Databases

"The Diamond Model helps analysts connect the attacker, the tools they use, the infrastructure supporting the attack, and the victim, providing a holistic view of the intrusion event."

(CCST Cybersecurity,Incident Handling, Threat Modeling section, Cisco Networking Academy)

In theCCST Cybersecuritycourse, Windows Event ViewerErrorevents in the Application log indicate a severe problem that caused an application or component to fail. This usually requires investigation or repair.

"Error events indicate a significant problem such as a loss of functionality in an application or system component. Errors are often critical and need immediate attention."

(CCST Cybersecurity,Incident Handling, Event Logging and Analysis section, Cisco Networking Academy)

Ais incorrect: Performance slowness would usually generate warnings, not errors.

Bis correct: An "Error" level in Event Viewer means the application failed in some way.

Cis incorrect: That describes an "Information" event, not an error.

Dis incorrect: That also corresponds to an "Information" event.

TheCCST Cybersecurity Study Guideexplains that hard disk encryption is a method used to protectdata stored on a physical devicefrom unauthorized access.

"Data at rest refers to data stored on a device, such as files on a hard drive, SSD, or removable media. Hard disk encryption protects data at rest by converting it into an unreadable format unless accessed with the correct decryption key."

(CCST Cybersecurity,Essential Security Principles, Data States and Protection Methods section, Cisco Networking Academy)

Data in processrefers to data actively being handled by applications in memory (RAM), which is not the primary target of disk encryption.

Data in transitis protected via encryption methods such as TLS, not disk encryption.

Data in useis accessed and manipulated by programs in real-time, also not the primary scope of disk encryption.

Data at restis the correct answer, as hard disk encryption directly safeguards stored files.

TheCCST Cybersecuritymaterial states that aVirtual Private Network (VPN)provides secure communication over an untrusted network, typically by ensuring:

Authentication→ verifying the identity of the user/device

Confidentiality→ encrypting the data so it cannot be read by unauthorized parties

Integrity→ ensuring that transmitted data has not been altered in transit

"VPNs secure remote access by authenticating users, encrypting data for confidentiality, and ensuring integrity through cryptographic checks."

(CCST Cybersecurity,Basic Network Security Concepts, VPNs section, Cisco Networking Academy)

Ais incorrect: WAN management is a network administration function, not a VPN feature.

Bis incorrect: Authorization is related but not a primary VPN security function.

Cis correct: Integrity is preserved through cryptographic hashing.

Dis correct: Authentication verifies user identity.

Eis correct: Confidentiality is provided via encryption.

Fis incorrect: Password management is separate from VPN functions.

TheCCST Cybersecurity Study Guidedescribes aman-in-the-middle (MITM)attack as an attack where the adversary secretly intercepts and possibly alters communications between two parties, making them believe they are communicating directly. A rogue AP configured to pass traffic through itself before sending it on is a classic wireless MITM method.

"In a MITM attack, the attacker places themselves between the sender and receiver, intercepting and possibly altering data in transit. Rogue access points can facilitate MITM attacks in wireless environments."

(CCST Cybersecurity,Basic Network Security Concepts, Wireless Threats section, Cisco Networking Academy)

Ais incorrect: Reconnaissance is information gathering, not active interception.

Bis correct: This is a wireless MITM attack.

Cis incorrect: DDoS aims to overwhelm a service, not intercept data.

Dis incorrect: Ransomware encrypts data for extortion.