A security analyst is researching a recently discovered software flaw. Which resource is the authoritative, publicly maintained catalog of standardized identifiers for publicly known vulnerabilities?

CWE (Common Weakness Enumeration)

CVE (Common Vulnerabilities and Exposures)

NVD (National Vulnerability Database)

CVSS (Common Vulnerability Scoring System)

A security team is considering subscribing to a threat intelligence platform that offers both a commercial feed and a community-sharing component. The team wants to ensure that the intelligence is relevant to their industry and that they can contribute their own indicators. However, the team is concerned about the quality of community-contributed data. What is the best way to evaluate the platform?

Choose the platform with the lowest subscription cost, because budget is the primary concern.

Avoid any platform with community-contributed data because it is inherently unreliable.

Review the platform's data quality metrics, such as false positive rates and source vetting processes, and test the feed with a pilot.

Select a platform that has the most community contributors, because more contributors means better data.

A security analyst reads a cybersecurity news article about a new ransomware campaign that exploits a specific VPN appliance vulnerability. The article includes indicators of compromise (IOCs) such as IP addresses and file hashes. Which action best uses this information to protect the organization?

Block all VPN traffic immediately because the article says the vulnerability is being exploited.

Ignore the article because news reports are not reliable sources of threat intelligence.

Search the organization's logs for the IOCs and check if the VPN appliance version is vulnerable.

Add the IOCs to a blocklist but do not check your own systems because the article is about other companies.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 4Objective 2

Use Threat Intelligence Techniques to Identify Potential Network Vulnerabilities 100-160 Practice Questions (Page 6)

Part of the Vulnerability Assessment and Risk Management domain, which makes up ~20% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–7 in this domain), expect 1–2 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 26–30

26application · medium
A security consultant is asked to assess the vulnerabilities of a web application. The consultant wants to use an industry-standard tool that can identify common web vulnerabilities and generate a report with recommendations. Which tool is most appropriate for this task?
Select an answer first
27foundation · easy
A security analyst is researching a recently discovered software flaw. Which resource is the authoritative, publicly maintained catalog of standardized identifiers for publicly known vulnerabilities?
Select an answer first
28foundation · easy
Which type of cybersecurity report typically provides a high-level summary of the threat landscape, including trends, emerging threats, and recommended mitigations?
Select an answer first
29expert · hard
A security team is considering subscribing to a threat intelligence platform that offers both a commercial feed and a community-sharing component. The team wants to ensure that the intelligence is relevant to their industry and that they can contribute their own indicators. However, the team is concerned about the quality of community-contributed data. What is the best way to evaluate the platform?
Select an answer first
30application · medium
A security analyst reads a cybersecurity news article about a new ransomware campaign that exploits a specific VPN appliance vulnerability. The article includes indicators of compromise (IOCs) such as IP addresses and file hashes. Which action best uses this information to protect the organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Use Threat Intelligence Techniques to Identify Potential Network Vulnerabilities 100-160 Practice Questions (Page 6)

Questions 26–30

A security consultant is asked to assess the vulnerabilities of a web application. The consultant wants to use an industry-standard tool that can identify common web vulnerabilities and generate a report with recommendations. Which tool is most appropriate for this task?

A security analyst is researching a recently discovered software flaw. Which resource is the authoritative, publicly maintained catalog of standardized identifiers for publicly known vulnerabilities?

Which type of cybersecurity report typically provides a high-level summary of the threat landscape, including trends, emerging threats, and recommended mitigations?

A security analyst reads a cybersecurity news article about a new ransomware campaign that exploits a specific VPN appliance vulnerability. The article includes indicators of compromise (IOCs) such as IP addresses and file hashes. Which action best uses this information to protect the organization?

Keep studying — Vulnerability Assessment and Risk Management