A system administrator is hardening a new web server. The server will only host a public website. The administrator wants to reduce the attack surface. Which action is most effective?

Install a second network interface card

Disable all unnecessary services and ports

In the context of system security, which of the following is an example of a vulnerability?

A phishing email that tricks users into revealing credentials

A hacker attempting to guess passwords

A software bug that allows an attacker to bypass authentication

The potential financial loss from a data breach

A security architect is designing a defense-in-depth strategy for a new application. The application will store sensitive customer data. The architect has already implemented network firewalls, an intrusion prevention system, and strong authentication. The architect wants to add another layer to protect the data at rest. Which control should the architect add?

An additional intrusion detection system

A second firewall in front of the application

Full-disk encryption on the database server

A company's web application has a known SQL injection vulnerability. An attacker discovers this and attempts to exploit it to extract customer data. In this scenario, what is the threat?

The attacker attempting to exploit the vulnerability

The SQL injection vulnerability

A cybersecurity professional discovers a vulnerability in a widely used software product. The professional is considering whether to disclose the vulnerability publicly or privately to the vendor. Which action best balances the ethical responsibilities of protecting the public and respecting the vendor's need to develop a fix?

Privately disclose the vulnerability to the vendor and allow a reasonable time for a fix before public disclosure.

Publicly disclose the vulnerability immediately to warn users.

Sell the vulnerability to a third party for financial gain.

Keep the vulnerability secret indefinitely to avoid causing panic.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 1Objective 1

Define Essential Security Principles 100-160 Practice Questions (Page 6)

Part of the Essential Security Principles domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 26–30

26application · medium
A system administrator is hardening a new web server. The server will only host a public website. The administrator wants to reduce the attack surface. Which action is most effective?
Select an answer first
27foundation · easy
In the context of system security, which of the following is an example of a vulnerability?
Select an answer first
28expert · hard
A security architect is designing a defense-in-depth strategy for a new application. The application will store sensitive customer data. The architect has already implemented network firewalls, an intrusion prevention system, and strong authentication. The architect wants to add another layer to protect the data at rest. Which control should the architect add?
Select an answer first
29application · medium
A company's web application has a known SQL injection vulnerability. An attacker discovers this and attempts to exploit it to extract customer data. In this scenario, what is the threat?
Select an answer first
30expert · hard
A cybersecurity professional discovers a vulnerability in a widely used software product. The professional is considering whether to disclose the vulnerability publicly or privately to the vendor. Which action best balances the ethical responsibilities of protecting the public and respecting the vendor's need to develop a fix?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Define Essential Security Principles 100-160 Practice Questions (Page 6)

Questions 26–30

A system administrator is hardening a new web server. The server will only host a public website. The administrator wants to reduce the attack surface. Which action is most effective?

In the context of system security, which of the following is an example of a vulnerability?

A company's web application has a known SQL injection vulnerability. An attacker discovers this and attempts to exploit it to extract customer data. In this scenario, what is the threat?

Keep studying — Essential Security Principles