CISCOCisco Certified Support Technician (CCST) Cybersecurity
The Cisco Certified Support Technician (CCST) Cybersecurity certification validates your entry-level skills and knowledge of core security concepts, including security principles, network security, endpoint security, vulnerability assessment, risk management, and incident handling. It is designed for individuals starting a career in cybersecurity, such as cybersecurity technicians, analysts, or Tier 1 help desk support. Earning this credential is also a first step toward the CyberOps Associate certification, giving you a clear path to advance in the security field.
942 practice questions · Updated 2025-01-01
5Domains
23Objectives
155Concepts
942Questions
100-160 Curriculum
Every domain, objective, and concept the 100-160 exam measures.
- Vulnerabilities
- Threats
- Exploits
- Risks
- Attack Vectors
- Hardening
- Defense-in-Depth
- Confidentiality, Integrity, and Availability (CIA)
- Types of Attackers
- Reasons for Attacks
- Code of Ethics
- Malware types and behaviors
- Ransomware attack mechanisms
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
- Botnets and their role in attacks
- Social engineering attack types
- Physical attacks and security measures
- Man-in-the-Middle (MitM) attacks
- IoT vulnerabilities and risks
- Insider threats and indicators
- Advanced Persistent Threats (APTs)
- AAA framework
- RADIUS protocol
- Multifactor authentication (MFA)
- Password policies
- Types of encryption
- Hashing
- Certificates
- Public Key Infrastructure (PKI)
- Strong vs. weak encryption algorithms
- States of data and appropriate encryption
- Protocols that use encryption
- TCP vulnerabilities
- UDP vulnerabilities
- HTTP vulnerabilities
- ARP vulnerabilities
- ICMP vulnerabilities
- DHCP vulnerabilities
- DNS vulnerabilities
- IPv4 Addressing Fundamentals
- IPv6 Addressing Fundamentals
- MAC Addresses and Their Role
- Network Segmentation Concepts
- CIDR Notation and Subnetting
- NAT and Its Security Implications
- Public vs. Private Networks
- Network Security Architecture
- DMZ (Demilitarized Zone)
- Virtualization
- Cloud Security
- Honeypot
- Proxy Server
- Intrusion Detection System (IDS)
- Intrusion Prevention System (IPS)
- MAC Address Filtering
- Encryption Standards and Protocols
- SSID Configuration
- Access Control Lists (ACLs)
- Firewalls
- Virtual Private Networks (VPNs)
- Network Access Control (NAC)
- OS Security Features Overview
- Windows Defender
- Host-Based Firewalls
- CLI and PowerShell
- File and Directory Permissions
- Privilege Escalation
- netstat
- nslookup
- tcpdump
- Hardware Inventory
- Software Inventory
- Program Deployment
- Data Backups
- Regulatory Compliance
- BYOD Device Management
- Data Encryption on BYOD
- App Distribution on BYOD
- Configuration Management
- Windows Update
- Application updates
- Device drivers
- Firmware updates
- Patch management
- Event Viewer basics
- Audit logs
- System logs
- Application logs
- Syslog
- Log analysis for anomaly identification
- Endpoint scanning methods
- Interpreting scan logs
- Malware remediation steps
- Post-remediation verification
- Vulnerability identification
- Vulnerability management lifecycle
- Vulnerability mitigation strategies
- Active reconnaissance
- Passive reconnaissance
- Port scanning
- Automation in vulnerability testing
- Vulnerability Databases
- Industry-Standard Vulnerability Assessment Tools
- Common Vulnerabilities and Exposures (CVEs)
- Cybersecurity Reports and News
- Subscription Services and Collective Intelligence
- Ad Hoc Threat Intelligence
- Automated Threat Intelligence
- Proactive Documentation and Communication
- Securing Documentation
- Sharing and Updating Documentation
- Vulnerability vs. Risk
- Risk Ranking
- Approaches to Risk Management
- Risk Mitigation Strategies
- Levels of Risk
- Risks Associated with Data Types and Classifications
- Security Assessments of IT Systems
- Natural and human-caused disasters
- Disaster Recovery Plan (DRP)
- Business Continuity Plan (BCP)
- Differences between DRP and BCP
- Backup strategies
- Detective disaster recovery controls
- Preventive disaster recovery controls
- Corrective disaster recovery controls
- SIEM fundamentals
- SOAR fundamentals
- Monitoring network data
- Analyzing log file entries
- Identifying suspicious events
- Escalation criteria and process
- Cyber Kill Chain
- MITRE ATT&CK Matrix
- Diamond Model of Intrusion Analysis
- Tactics, Techniques, and Procedures (TTPs)
- Sources of Digital Evidence (Artifacts)
- Preserving Digital Evidence
- Chain of Custody
- Overview of compliance frameworks
- GDPR reporting and notification requirements
- HIPAA reporting and notification requirements
- PCI-DSS reporting and notification requirements
- FERPA reporting and notification requirements
- FISMA reporting and notification requirements
- Impact of frameworks on incident handling processes
- Coordination of multiple frameworks
- Incident Response Policy
- Incident Response Plan
- Incident Response Procedures
- NIST Incident Response Lifecycle
- Preparation Stage
- Detection and Analysis Stage
- Containment, Eradication, and Recovery Stage
- Post-Incident Activity Stage
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for 100-160, so none is invented.