During an incident investigation, an analyst sees that the attacker first performed reconnaissance on the company's LinkedIn page, then sent a spear-phishing email with a malicious attachment, and later established a command-and-control channel. The analyst wants to describe this progression using the Cyber Kill Chain. Which two phases are most directly demonstrated by the reconnaissance and the command-and-control channel?

Reconnaissance and Command & Control

Actions on Objectives and Exfiltration

A forensic investigator has collected a laptop from a suspected insider threat. The investigator must ensure the evidence is admissible in court. Which practice is MOST critical to maintain the integrity of the evidence?

Using the latest forensic software to analyze the drive.

Documenting every person who handled the evidence and when.

Storing the laptop in a secure evidence locker.

Making a bit-for-bit copy of the hard drive.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 2

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 4)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 16–20

16application · medium
A security analyst is documenting an attack where the adversary used PowerShell to download and execute a script. The analyst is categorizing the behavior using TTPs. Which classification best describes the use of PowerShell?
Select an answer first
17application · medium
During an incident investigation, an analyst sees that the attacker first performed reconnaissance on the company's LinkedIn page, then sent a spear-phishing email with a malicious attachment, and later established a command-and-control channel. The analyst wants to describe this progression using the Cyber Kill Chain. Which two phases are most directly demonstrated by the reconnaissance and the command-and-control channel?
Select an answer first
18application · medium
During an incident investigation, a security analyst notices that an attacker sent a phishing email to several employees, and one employee clicked the link, which downloaded a malicious file. According to the Cyber Kill Chain, which phase does the download represent?
Select an answer first
19application · medium
A forensic investigator has collected a laptop from a suspected insider threat. The investigator must ensure the evidence is admissible in court. Which practice is MOST critical to maintain the integrity of the evidence?
Select an answer first
20foundation · easy
In the Cyber Kill Chain, which phase immediately follows the 'Weaponization' phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 4)

Questions 16–20

A security analyst is documenting an attack where the adversary used PowerShell to download and execute a script. The analyst is categorizing the behavior using TTPs. Which classification best describes the use of PowerShell?

During an incident investigation, a security analyst notices that an attacker sent a phishing email to several employees, and one employee clicked the link, which downloaded a malicious file. According to the Cyber Kill Chain, which phase does the download represent?

A forensic investigator has collected a laptop from a suspected insider threat. The investigator must ensure the evidence is admissible in court. Which practice is MOST critical to maintain the integrity of the evidence?

In the Cyber Kill Chain, which phase immediately follows the 'Weaponization' phase?

Keep studying — Incident Handling