A company installs smart thermostats and IP cameras on its office network. The security team is concerned about the devices being compromised. Which vulnerability is most common in IoT devices that could lead to them being used in a botnet?

Default credentials that are not changed

Inability to connect to the internet

Lack of a graphical user interface

During a ransomware incident, the attacker encrypts critical files and leaves a note demanding payment in cryptocurrency. What is the primary purpose of the encryption in this attack?

To corrupt the victim's backup files

To slow down the victim's network

To hide the attacker's identity

To prevent the victim from accessing their data

A hospital's patient records are encrypted, and a ransom note demands payment in cryptocurrency. The IT team suspects an employee clicked a malicious link in a phishing email. Which immediate action should the team take to limit the spread of the ransomware?

Reboot all servers to clear the encryption

Change all user passwords immediately

Pay the ransom to restore access quickly

Disconnect affected systems from the network

An employee's workstation is infected with malware after they clicked a link in a phishing email. The employee had administrative privileges and had previously ignored security warnings. Which type of insider threat does this represent, and what is the most effective control to reduce the risk?

Negligent insider; install antivirus software

Compromised insider; reimage the workstation

Malicious insider; revoke administrative privileges

Negligent insider; implement least privilege and provide security awareness training

An employee receives a text message on their personal phone that appears to be from their bank, asking them to verify a suspicious transaction by clicking a link and entering their online banking credentials. The employee is about to click the link. Which type of social engineering attack is this, and what is the best immediate action for the employee?

Smishing; contact the bank using a verified phone number

Spear phishing; forward the message to the IT department

Phishing; click the link to check the website

Vishing; reply to the text message

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 1Objective 2

Explain Common Threats and Vulnerabilities 100-160 Practice Questions (Page 9)

Part of the Essential Security Principles domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 41–45

41application · medium
A company installs smart thermostats and IP cameras on its office network. The security team is concerned about the devices being compromised. Which vulnerability is most common in IoT devices that could lead to them being used in a botnet?
Select an answer first
42foundation · easy
During a ransomware incident, the attacker encrypts critical files and leaves a note demanding payment in cryptocurrency. What is the primary purpose of the encryption in this attack?
Select an answer first
43application · medium
A hospital's patient records are encrypted, and a ransom note demands payment in cryptocurrency. The IT team suspects an employee clicked a malicious link in a phishing email. Which immediate action should the team take to limit the spread of the ransomware?
Select an answer first
44application · medium
An employee's workstation is infected with malware after they clicked a link in a phishing email. The employee had administrative privileges and had previously ignored security warnings. Which type of insider threat does this represent, and what is the most effective control to reduce the risk?
Select an answer first
45application · medium
An employee receives a text message on their personal phone that appears to be from their bank, asking them to verify a suspicious transaction by clicking a link and entering their online banking credentials. The employee is about to click the link. Which type of social engineering attack is this, and what is the best immediate action for the employee?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.