A security analyst is verifying that a company's web server hostname resolves to the correct IP address after a recent DNS change. The analyst wants to query the authoritative DNS server directly, bypassing the local cache. Which command should be used?

nslookup www.example.com 8.8.8.8

A security analyst is verifying whether a recently reported phishing domain resolves to an IP address that is already known to be malicious. The analyst has the domain name but needs to confirm the current IP address and the authoritative name servers for the domain. Which command provides both pieces of information?

nslookup -type=any phishing-example.com

nslookup -type=MX phishing-example.com

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 3Objective 2

Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 1)

Part of the Endpoint Security Concepts domain, which makes up ~25% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

3concepts

Questions 1–5

1foundation · easy
An analyst wants to see the IP routing table on a Linux host to verify the default gateway and static routes. Which netstat option provides this information?
Select an answer first
2foundation · easy
An analyst wants to use tcpdump to capture only packets on port 443 (HTTPS) to monitor encrypted web traffic. Which tcpdump filter expression is correct?
Select an answer first
3application · medium
A technician is investigating a Windows workstation that is suspected of beaconing to a command-and-control server. The technician needs to identify which process is associated with the suspicious outbound connection. Which command should the technician run first?
Select an answer first
4application · medium
A security analyst is verifying that a company's web server hostname resolves to the correct IP address after a recent DNS change. The analyst wants to query the authoritative DNS server directly, bypassing the local cache. Which command should be used?
Select an answer first
5application · medium
A security analyst is verifying whether a recently reported phishing domain resolves to an IP address that is already known to be malicious. The analyst has the domain name but needs to confirm the current IP address and the authoritative name servers for the domain. Which command provides both pieces of information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 1)

Questions 1–5

An analyst wants to see the IP routing table on a Linux host to verify the default gateway and static routes. Which netstat option provides this information?

An analyst wants to use tcpdump to capture only packets on port 443 (HTTPS) to monitor encrypted web traffic. Which tcpdump filter expression is correct?

A technician is investigating a Windows workstation that is suspected of beaconing to a command-and-control server. The technician needs to identify which process is associated with the suspicious outbound connection. Which command should the technician run first?

A security analyst is verifying that a company's web server hostname resolves to the correct IP address after a recent DNS change. The analyst wants to query the authoritative DNS server directly, bypassing the local cache. Which command should be used?

Keep studying — Endpoint Security Concepts