An administrator reviews a scan log that shows multiple detections of the same file with different severity levels: 'Low' and 'High'. The file is a signed Microsoft executable. What is the most likely explanation?

The detections are from different scan engines or heuristics, and the signed executable may be a false positive

The file is corrupted and needs to be replaced

The administrator should immediately delete the file

The file is definitely malicious because it was detected twice

After removing a banking trojan from a finance department laptop, the administrator runs a full scan with the corporate antivirus and it is clean. The trojan is known to modify the hosts file to redirect banking sites. The administrator checks the hosts file and finds no suspicious entries. What is the most important additional verification step?

Run a quick scan instead of a full scan

Verify that the user's browser bookmarks are unchanged

Reimage the laptop because the hosts file could be restored by the trojan

Check the DNS resolver cache and network proxy settings for unauthorized changes

What is the purpose of rescanning an endpoint after malware removal?

To confirm that all malicious files and registry entries have been removed

To update the antivirus software to the latest version

A security analyst needs to scan a Windows server for malware without relying on the installed antivirus, because the antivirus may have been disabled by the attacker. The analyst wants to check running processes and network connections for signs of infection. Which approach is most effective?

Run a portable scanner from a read-only USB drive and use built-in tools to list processes and connections

Run a network scan from another machine to detect malware on the server

Use Windows Defender offline scan

Boot the server into Safe Mode and run the installed antivirus

A technician has removed a ransomware infection from a user's PC by restoring encrypted files from backup and running a full antivirus scan with no detections. The user is concerned that the ransomware might still be present. What should the technician do to provide the strongest assurance?

Reformat the hard drive and reinstall the operating system

Disable system restore to prevent the ransomware from coming back

Run a second full scan with a different antivirus engine and check for suspicious scheduled tasks or startup entries

Tell the user that the scan was clean and the system is safe

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 3Objective 6

Demonstrate Familiarity with Malware Removal 100-160 Practice Questions (Page 1)

Part of the Endpoint Security Concepts domain, which makes up ~25% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 1–5

1application · medium
An administrator reviews a scan log that shows multiple detections of the same file with different severity levels: 'Low' and 'High'. The file is a signed Microsoft executable. What is the most likely explanation?
Select an answer first
2expert · hard
After removing a banking trojan from a finance department laptop, the administrator runs a full scan with the corporate antivirus and it is clean. The trojan is known to modify the hosts file to redirect banking sites. The administrator checks the hosts file and finds no suspicious entries. What is the most important additional verification step?
Select an answer first
3foundation · easy
What is the purpose of rescanning an endpoint after malware removal?
Select an answer first
4application · medium
A security analyst needs to scan a Windows server for malware without relying on the installed antivirus, because the antivirus may have been disabled by the attacker. The analyst wants to check running processes and network connections for signs of infection. Which approach is most effective?
Select an answer first
5application · medium
A technician has removed a ransomware infection from a user's PC by restoring encrypted files from backup and running a full antivirus scan with no detections. The user is concerned that the ransomware might still be present. What should the technician do to provide the strongest assurance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.