Cisco Certified Support Technician (CCST) Cybersecurity (100-160)

This question tests knowledge of fundamental cybersecurity concepts as defined by standards bodies like NIST. The correct pairings are based on these industry-standard definitions.

Correct Mappings:

✅ Asset matches with -> People, property, or data
Reasoning: An asset is anything that has value to an organization. This includes tangible items like property and equipment, and intangible items like data, reputation, and personnel.

✅ Threat matches with -> An action that causes a negative impact
Reasoning: A threat is any circumstance or event with the potential to adversely impact organizational operations or assets. It represents the potential negative action against an asset.

✅ Risk matches with -> The potential for loss, damage, or destruction
Reasoning: Risk is a measure of the potential for loss resulting from a threat exploiting a vulnerability. It combines the probability of the event and its negative impact.

✅ Vulnerability matches with -> A weakness that potentially exposes organizations to cyber attacks
Reasoning: A vulnerability is a weakness in a system, process, or control that can be exploited by a threat actor to cause harm.

Reference: https://csrc.nist.gov/glossary

This question requires matching well-known cybersecurity and privacy frameworks to their specific purposes. Each framework is designed to protect a particular type of data or applies to a specific industry or region. The solution correctly aligns each acronym with its definition.

✅ GDPR matches with -> Protects the personal information of members of the European Union
Reasoning: The General Data Protection Regulation (GDPR) is a comprehensive data privacy law from the European Union. It regulates how companies worldwide can collect, use, and store the personal data of EU citizens.

✅ HIPAA matches with -> Protects the healthcare information of individuals
Reasoning: The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law. Its primary purpose is to set national standards for protecting sensitive patient health information (PHI) from being disclosed without consent.

✅ PCI-DSS matches with -> Protects the credit card information of individuals
Reasoning: The Payment Card Industry Data Security Standard (PCI-DSS) is a global information security standard. It applies to any organization that accepts, processes, stores, or transmits cardholder data.

✅ FERPA matches with -> Protects the educational records of individuals
Reasoning: The Family Educational Rights and Privacy Act (FERPA) is a U.S. federal law that protects the privacy of student education records. It gives parents and eligible students rights over those records.

✅ FISMA matches with -> Protects information about individuals that is stored by federal agencies
Reasoning: The Federal Information Security Modernization Act (FISMA) is a U.S. federal law requiring federal agencies to implement robust security programs for their information systems, including those storing personal data.

Reference: https://www.cisco.com/c/en/us/products/security/what-is-cybersecurity.html#~cybersecurity-frameworks-and-compliance-regulations

✅ Option D (Correct)

An Advanced Persistent Threat (APT) involves a prolonged, covert, and sophisticated cyberattack where an unauthorized user gains access to a network and remains undetected for an extended period. The goal is typically data exfiltration, espionage, or sabotage, perfectly aligning with the scenario's description of a competitor establishing a "prolonged and in-depth presence" to "steal or sabotage sensitive data."

❌ Why the other choices are incorrect:

• Option A is incorrect: DDoS (Distributed Denial of Service) attacks aim to disrupt service by overwhelming a system with traffic, not to maintain a prolonged presence for data theft or sabotage.
• Option B is incorrect: Ransomware encrypts data and demands payment for its release, which is not the primary objective described in the scenario.
• Option C is incorrect: Man-in-the-middle attacks involve intercepting communication between two parties. While data can be stolen, it doesn't encompass the broad "prolonged and in-depth presence" for varied sabotage or theft described.

Multifactor authentication (MFA) relies on combining two or more distinct types of authentication factors to verify a user's identity. The three primary and universally recognized categories of authentication factors are:

• A: Something you have: Refers to a physical object, such as a smart card, security token, or a mobile device receiving a one-time password.
• B: Something you are: Pertains to inherent physical characteristics, also known as biometrics, like a fingerprint, facial scan, or iris recognition.
• C: Something you know: Involves secret knowledge, typically a password, PIN, or a security question's answer.

Options D, E, and F are not standard, universally accepted authentication factors in cybersecurity frameworks.

✅ Option D (Correct) Reasoning: Hashing produces a unique, fixed-size value (hash) from data. If the data is altered in any way, the resulting hash will change significantly. This allows recipients to detect if data has been modified during transit or storage, directly ensuring data integrity. ❌ Why the other choices are incorrect: * Option A is incorrect: Hashing is a component in digital signatures, which provide non-repudiation, but hashing alone does not offer this. * Option B is incorrect: Origin authentication often utilizes hashing within digital signatures or MACs but requires cryptographic keys, not just hashing. * Option C is incorrect: Hashing is a one-way function for data verification, not a method for encrypting or concealing data content.

✅ Option A (Spear phishing) (Correct)

Reasoning: Spear phishing targets specific individuals or departments, leveraging personalized information or relevant topics to appear legitimate. The email to the accounting department, discussing federal regulations and financial security, with a hyperlink to an 'unknown party,' precisely matches this highly targeted and deceptive attack method aimed at exploiting trust to gain access or information.

❌ Why the other choices are incorrect:

• Option B is incorrect: Ransomware is a malicious payload that encrypts data, demanding ransom. While it could be the result of a spear phishing attack, the initial threat of the suspicious email and hyperlink is the phishing attempt itself, not the ransomware payload.
• Option C is incorrect: Smishing involves phishing attacks conducted via SMS text messages. The scenario explicitly states the threat originated from an 'email,' making smishing an incorrect classification for this specific incident.
• Option D is incorrect: Vishing refers to phishing attacks delivered through voice calls. As the threat vector described is an 'email' containing a hyperlink, vishing is not applicable to this scenario.

This question assesses understanding of the core ethical principles in cybersecurity. The correct selections align with industry-standard codes of conduct regarding authorization, privacy, and confidentiality. Each statement must be evaluated against these principles.

✅ A security analyst may use a disgruntled employee's network credentials to monitor behavior. -> False

Reasoning: Using another person's credentials, regardless of the reason, is unethical and likely illegal. It violates privacy, accountability, and non-repudiation principles. Proper monitoring must be conducted through authorized, transparent security tools and processes, not by impersonating a user, which compromises investigations and trust.

✅ A security analyst may access employee data on a company server if authorized. -> True

Reasoning: Authorization is the key ethical determinant. Security analysts often require access to sensitive data to perform their duties, such as incident response or security audits. This action is ethical and professionally acceptable as long as it is explicitly authorized by company policy and is within the defined scope of their job.

✅ A security analyst may share sensitive data with unauthorized users. -> False

Reasoning: This is a direct violation of the principle of confidentiality, a fundamental tenet of cybersecurity ethics. A security professional's primary duty is to protect data. Disclosing sensitive information to individuals without a legitimate need-to-know and proper authorization constitutes a severe ethical and professional breach.

Reference: https://www.isc2.org/ethics

The described scenario is a classic example of multifactor authentication (MFA). MFA requires a user to present two or more distinct authentication factors from different categories to verify their identity. In this instance, the strong password represents 'something you know,' and the 5-digit code sent to the smartphone represents 'something you have.' Both factors must be provided for successful authentication.

VPN refers to a secure network connection, not an authentication type. RADIUS is an authentication protocol. AAA is a framework (Authentication, Authorization, Accounting) for managing user access, not a specific method of combining authentication factors.

✅ Option D (Correct)
Reasoning: Sending an email with a link to a fictitious web portal login page describes a phishing attack. Phishing is a social engineering exploit specifically designed to trick users into voluntarily entering their credentials on a fake site, allowing the adversary to gain them.

❌ Why the other choices are incorrect:

• Option A is incorrect: Obtaining a directory listing is an information gathering or reconnaissance activity, not a direct attempt to gain user credentials.
• Option B is incorrect: Installing a backdoor is a post-exploitation activity for maintaining access and control, not primarily for initial credential acquisition.
• Option C is incorrect: Executing a remote port scan is a reconnaissance phase activity to identify open services, preceding any attempt to gain credentials.

This question tests knowledge of the fundamental cybersecurity model, the CIA Triad. Each definition must be matched to its corresponding principle. The mappings are based on the standard industry definitions of these terms.

The Correct Mappings:

✅ Confidentiality matches with -> Data should be accessed and read only by authorized users.
Reasoning: Confidentiality is the principle of preventing unauthorized disclosure of information. It ensures that data is accessible only to those who are authorized, aligning perfectly with this definition.

✅ Integrity matches with -> Data should never be altered or compromised.
Reasoning: Integrity ensures that data is accurate, consistent, and trustworthy over its entire lifecycle. This definition directly reflects the core goal of preventing unauthorized modification or corruption of data.

✅ Availability matches with -> Legitimate requests should have access to data at all times.
Reasoning: Availability ensures that systems and data are operational and accessible to authorized users when needed. This definition describes the core function of availability in the CIA triad.

Reference: https://www.cisco.com/c/en/us/products/security/what-is-the-cia-triad.html