← Back
CCST-160

Cisco 100-160 · Cybersecurity Fragen

Speaking-Fragenkatalog zur CCST-Cybersecurity-Prüfung: CIA-Triade, Kryptografie, Netzwerksicherheit, Endpoint Security, Incident Response, Forensik, Risiko und Compliance.

576 Fragen

1.1 Cybersecurity Fundamentals

  1. What is cybersecurity?
  2. Why is cybersecurity important for organizations?
  3. What are the main goals of cybersecurity?
  4. What is the difference between cybersecurity and information security?
  5. What is the CIA triad?
  6. What does confidentiality mean?
  7. What does integrity mean?
  8. What does availability mean?
  9. Can you give an example of a confidentiality violation?
  10. Can you give an example of an integrity violation?
  11. Can you give an example of an availability violation?
  12. Why is the CIA triad important?
  13. What is authentication?
  14. What is authorization?
  15. What is accounting or auditing?
  16. What is the difference between authentication and authorization?
  17. What is non-repudiation?
  18. What is accountability?
  19. What is the principle of least privilege?
  20. Why is least privilege important?
  21. What is defense in depth?
  22. Why should an organization use multiple layers of security?
  23. What is Zero Trust?
  24. What does "never trust, always verify" mean?
  25. How is Zero Trust different from a traditional security model?

2.1 Basic Concepts

  1. What is a threat?
  2. What is a vulnerability?
  3. What is a risk?
  4. What is an exploit?
  5. What is an attack?
  6. What is an attack vector?
  7. What is an asset?
  8. What is a threat actor?
  9. What is the difference between a threat and a vulnerability?
  10. How are threats, vulnerabilities and risks related?
  11. Can a vulnerability exist without being exploited?
  12. What makes a vulnerability dangerous?
  13. What is a security weakness?
  14. What is a zero-day vulnerability?
  15. Why are zero-day vulnerabilities dangerous?

2.2 Common Cyberattacks

  1. What is malware?
  2. What is a virus?
  3. What is a worm?
  4. What is a Trojan horse?
  5. What is ransomware?
  6. What is spyware?
  7. What is a rootkit?
  8. What is a keylogger?
  9. What is a botnet?
  10. What is a backdoor?
  11. What is phishing?
  12. What is spear phishing?
  13. What is whaling?
  14. What is social engineering?
  15. What is pretexting?
  16. What is baiting?
  17. What is tailgating?
  18. What is credential theft?
  19. What is password spraying?
  20. What is brute-force authentication?
  21. What is credential stuffing?
  22. What is denial-of-service?
  23. What is distributed denial-of-service?
  24. What is a man-in-the-middle attack?
  25. What is spoofing?
  26. What is IP spoofing?
  27. What is DNS spoofing?
  28. What is session hijacking?
  29. What is a replay attack?
  30. What is a privilege escalation attack?

3.1 Authentication

  1. What is authentication?
  2. What are the three main authentication factors?
  3. What is something you know?
  4. What is something you have?
  5. What is something you are?
  6. What is multifactor authentication?
  7. Why is MFA more secure than a password alone?
  8. What is biometric authentication?
  9. What are the advantages of biometric authentication?
  10. What are the disadvantages of biometric authentication?
  11. What is single sign-on?
  12. What are the advantages of SSO?
  13. What are the risks of SSO?

3.2 Authorization and Access Control

  1. What is authorization?
  2. What is access control?
  3. What is role-based access control?
  4. What is attribute-based access control?
  5. What is mandatory access control?
  6. What is discretionary access control?
  7. What is the principle of least privilege?
  8. What is privilege escalation?
  9. Why should administrator accounts be protected?
  10. Why should users not have administrator privileges unnecessarily?
  11. What is account lockout?
  12. Why can account lockout improve security?
  13. What problems can excessive account lockout cause?

4.1 Encryption Fundamentals

  1. What is encryption?
  2. Why is encryption used?
  3. What is plaintext?
  4. What is ciphertext?
  5. What is a cryptographic key?
  6. What is symmetric encryption?
  7. What is asymmetric encryption?
  8. What is the difference between symmetric and asymmetric encryption?
  9. What are the advantages of symmetric encryption?
  10. What are the advantages of asymmetric encryption?
  11. What is AES?
  12. What is RSA?
  13. What is ECC?
  14. Why is AES commonly used for encrypting large amounts of data?
  15. Why is asymmetric cryptography useful for key exchange?
  16. What is a digital certificate?
  17. What is a public key?
  18. What is a private key?
  19. Why must a private key remain secret?
  20. What is a digital signature?
  21. What does a digital signature provide?
  22. What is hashing?
  23. How is hashing different from encryption?
  24. What is SHA-256?
  25. Why are passwords normally stored as hashes rather than plaintext?
  26. What is salting?
  27. Why is a salt used when hashing passwords?
  28. What is TLS?
  29. How does HTTPS use cryptography?
  30. What is the difference between HTTP and HTTPS?

5.1 Network Models

  1. What is a computer network?
  2. What is the OSI model?
  3. What are the seven OSI layers?
  4. What is the purpose of the Physical layer?
  5. What is the purpose of the Data Link layer?
  6. What is the purpose of the Network layer?
  7. What is the purpose of the Transport layer?
  8. What is the purpose of the Session layer?
  9. What is the purpose of the Presentation layer?
  10. What is the purpose of the Application layer?
  11. What is the TCP/IP model?
  12. How does the TCP/IP model compare with the OSI model?
  13. Why is understanding network layers important for cybersecurity?

5.2 TCP/IP

  1. What is an IP address?
  2. What is IPv4?
  3. What is IPv6?
  4. What is a MAC address?
  5. What is the difference between an IP address and a MAC address?
  6. What is a subnet mask?
  7. What is a default gateway?
  8. What is a private IP address?
  9. What is a public IP address?
  10. What is NAT?
  11. Why is NAT commonly used?
  12. What is TCP?
  13. What is UDP?
  14. What is the difference between TCP and UDP?
  15. Why does TCP provide reliable communication?
  16. What is a TCP three-way handshake?
  17. What is a TCP port?
  18. What is an ephemeral port?
  19. Why are ports important for network security?
  20. What is ICMP?

6.1 Common Protocols

  1. What is DNS?
  2. How does DNS work?
  3. Why is DNS important?
  4. What security problems can DNS have?
  5. What is DNS spoofing?
  6. What is DHCP?
  7. How does DHCP work?
  8. What security risks can DHCP have?
  9. What is ARP?
  10. How does ARP work?
  11. What is ARP spoofing?
  12. What is HTTP?
  13. What is HTTPS?
  14. What is FTP?
  15. Why is FTP considered insecure?
  16. What is SFTP?
  17. What is SSH?
  18. Why is SSH preferred over Telnet?
  19. What is Telnet?
  20. Why is Telnet insecure?
  21. What is SMTP?
  22. What is POP3?
  23. What is IMAP?
  24. What is SNMP?
  25. Why should insecure protocols be replaced with secure alternatives?

7.1 Network Devices

  1. What is a switch?
  2. What is a router?
  3. What is a firewall?
  4. What is a wireless access point?
  5. What is a modem?
  6. What is a hub?
  7. What is the difference between a hub and a switch?
  8. What is the difference between a switch and a router?
  9. What is the role of a firewall?
  10. Where can a firewall be deployed?
  11. What is a wireless LAN?
  12. What is a WLAN controller?
  13. What is network segmentation?
  14. Why is network segmentation important for security?
  15. What is a VLAN?
  16. How can VLANs improve network security?
  17. What is a DMZ?
  18. Why would an organization use a DMZ?

8.1 Secure Wireless Networks

  1. What are the main security risks of wireless networks?
  2. What is an SSID?
  3. What is WPA2?
  4. What is WPA3?
  5. What is the difference between WPA2 and WPA3?
  6. What is Wi-Fi encryption?
  7. Why should WEP not be used?
  8. What is a strong wireless password?
  9. Why should the default administrator password be changed?
  10. Why should wireless firmware be updated?
  11. What is a guest network?
  12. Why should guest devices be isolated from internal systems?
  13. How would you secure a small home or SOHO wireless network?
  14. What is an evil twin attack?
  15. How can users protect themselves from rogue wireless networks?

9.1 Firewalls

  1. What is a firewall?
  2. What is the purpose of a firewall?
  3. How does a firewall filter traffic?
  4. What is a firewall rule?
  5. What is an allow rule?
  6. What is a deny rule?
  7. What is the principle of default deny?
  8. What is a stateful firewall?
  9. What is a stateless firewall?
  10. What is a host-based firewall?
  11. What is a network firewall?
  12. What is an application firewall?
  13. What is a next-generation firewall?
  14. Why should firewall rules be reviewed regularly?
  15. What can happen if a firewall rule is too permissive?

9.2 IDS and IPS

  1. What is an IDS?
  2. What is an IPS?
  3. What is the difference between IDS and IPS?
  4. Where can an IDS be deployed?
  5. Where can an IPS be deployed?
  6. What is signature-based detection?
  7. What is anomaly-based detection?
  8. What is a false positive?
  9. What is a false negative?
  10. Why are false positives a problem?
  11. Why are false negatives dangerous?

10.1 Operating System Security

  1. What is endpoint security?
  2. What is an endpoint?
  3. Why are endpoints attractive targets for attackers?
  4. What is endpoint hardening?
  5. What does a secure operating system configuration look like?
  6. Why should unnecessary services be disabled?
  7. Why should unused applications be removed?
  8. Why are operating system updates important?
  9. What is a security patch?
  10. What is patch management?
  11. Why should endpoint software be kept up to date?
  12. What is antivirus software?
  13. What is antimalware software?
  14. What is EDR?
  15. What information can endpoint security tools collect?
  16. What is application allowlisting?
  17. What is application blocklisting?
  18. Why is application control useful?

10.2 Endpoint Security Policies

  1. What is a security baseline?
  2. What is a security policy?
  3. What is configuration management?
  4. Why should endpoint configurations be standardized?
  5. How can you verify that an endpoint complies with a security policy?
  6. What should you do if an endpoint violates a security policy?
  7. Why are software updates important for security?
  8. Why are hardware updates sometimes necessary for security?

11.1 Malware Detection and Removal

  1. What is malware?
  2. How can malware enter an endpoint?
  3. What is ransomware?
  4. How does ransomware affect an organization?
  5. What is a Trojan?
  6. What is a worm?
  7. What is spyware?
  8. What is a rootkit?
  9. What is a botnet?
  10. What signs may indicate malware infection?
  11. What should you do when malware is suspected?
  12. Why should an infected computer sometimes be isolated from the network?
  13. Why should malware removal be documented?
  14. Why should backups be protected against ransomware?
  15. What is the difference between detecting malware and removing malware?

12.1 System Logs

  1. What is a log?
  2. Why are logs important for cybersecurity?
  3. What information can a security log contain?
  4. What is an event?
  5. What is a security event?
  6. What is a security incident?
  7. What is the difference between an event and an incident?
  8. What is log analysis?
  9. What is centralized logging?
  10. Why should logs be stored centrally?
  11. What is a SIEM?
  12. What does a SIEM do?
  13. What types of logs can a SIEM collect?
  14. What is log correlation?
  15. Why is time synchronization important for log analysis?
  16. What is a suspicious login event?
  17. What log information would you examine after a suspected attack?
  18. When should a security event be escalated?

13.1 Vulnerability Assessment

  1. What is vulnerability management?
  2. What is vulnerability assessment?
  3. What is vulnerability scanning?
  4. What is a vulnerability scanner?
  5. What can a vulnerability scanner identify?
  6. What is the difference between vulnerability scanning and penetration testing?
  7. What is CVE?
  8. What is CVSS?
  9. What does a CVSS score tell you?
  10. Why should vulnerabilities be prioritized?
  11. Which vulnerabilities should normally be fixed first?
  12. What factors should be considered when prioritizing vulnerabilities?
  13. What is remediation?
  14. What is mitigation?
  15. What is a compensating control?
  16. What is a security baseline?
  17. Why should vulnerability scans be performed regularly?
  18. What problems can vulnerability scanners have?
  19. What is a false positive in vulnerability scanning?
  20. What is vulnerability remediation management?

14.1 Risk Fundamentals

  1. What is cybersecurity risk?
  2. How are threats and vulnerabilities related to risk?
  3. What is risk assessment?
  4. What is risk analysis?
  5. What is qualitative risk analysis?
  6. What is quantitative risk analysis?
  7. What is risk likelihood?
  8. What is risk impact?
  9. How can an organization prioritize risks?
  10. What is risk mitigation?
  11. What is risk avoidance?
  12. What is risk transfer?
  13. What is risk acceptance?
  14. What is a risk register?
  15. Why should organizations maintain a risk register?
  16. What is residual risk?
  17. What is inherent risk?
  18. What is the difference between inherent and residual risk?

15.1 Cyber Threat Intelligence

  1. What is threat intelligence?
  2. Why is threat intelligence important?
  3. What is an indicator of compromise?
  4. What is an IOC?
  5. What can be used as an IOC?
  6. What is a threat intelligence feed?
  7. What is a threat intelligence platform?
  8. What information can threat intelligence provide?
  9. What is the difference between threat intelligence and a vulnerability scan?
  10. What is threat hunting?
  11. How is threat hunting different from incident response?
  12. What is a threat actor?
  13. What is an attack technique?
  14. What is TTP?
  15. What is MITRE ATT&CK?
  16. How can MITRE ATT&CK help security analysts?
  17. How can threat intelligence help identify potential attacks?

16.1 Incident Handling

  1. What is a cybersecurity incident?
  2. What is incident response?
  3. Why is incident response important?
  4. What are the main phases of incident response?
  5. What happens during preparation?
  6. What happens during detection and analysis?
  7. What happens during containment?
  8. What happens during eradication?
  9. What happens during recovery?
  10. What is the purpose of lessons learned?
  11. Why should incident response procedures be documented?
  12. What is an incident response plan?
  13. What is an incident response playbook?
  14. What is the difference between a plan and a playbook?
  15. When should an incident be escalated?
  16. Who should be involved in incident response?
  17. Why is documentation important during an incident?
  18. What information should be recorded during an incident?
  19. Why should evidence be preserved?
  20. What mistakes should an incident responder avoid?

17.1 Phishing Incident

  1. What would you do if an employee reports a suspicious email?
  2. How would you determine whether an email is phishing?
  3. What information would you collect?
  4. How would you contain the incident?
  5. What would you do if the user clicked the link?
  6. What would you do if the user entered their password?
  7. How would you determine whether other users were affected?

17.2 Malware Incident

  1. What would you do if an endpoint suddenly starts behaving suspiciously?
  2. How would you determine whether the endpoint is infected?
  3. When should the endpoint be isolated?
  4. What evidence should be collected?
  5. How would you remove the malware?
  6. How would you verify that the system is clean?
  7. What should happen after malware removal?

17.3 Account Compromise

  1. What signs could indicate that an account has been compromised?
  2. What would you do after detecting suspicious authentication activity?
  3. How would you contain a compromised account?
  4. When should a password be reset?
  5. Why might MFA need to be enabled?
  6. What logs would you examine?
  7. How would you determine whether the attacker accessed other systems?

18.1 Forensic Fundamentals

  1. What is digital forensics?
  2. Why is digital forensics important after a cyberattack?
  3. What types of digital evidence can investigators collect?
  4. What is volatile data?
  5. What is non-volatile data?
  6. Why should volatile data sometimes be collected first?
  7. What is forensic imaging?
  8. Why should investigators work with copies of evidence?
  9. What is chain of custody?
  10. Why is chain of custody important?
  11. What can system logs reveal during an investigation?
  12. What can network logs reveal?
  13. What can endpoint logs reveal?
  14. What is attack attribution?
  15. Why can attribution be difficult?

19.1 Continuity Planning

  1. What is business continuity?
  2. What is disaster recovery?
  3. What is the difference between business continuity and disaster recovery?
  4. Why is disaster recovery important for cybersecurity?
  5. What is a disaster recovery plan?
  6. What is a business continuity plan?
  7. What is a backup?
  8. Why are backups important against ransomware?
  9. What is the 3-2-1 backup strategy?
  10. What is an offline backup?
  11. What is an immutable backup?
  12. What is RTO?
  13. What is RPO?
  14. What is the difference between RTO and RPO?
  15. Why should disaster recovery plans be tested?
  16. What can happen if backups have never been tested?

20.1 Security Policies

  1. What is a security policy?
  2. Why do organizations need security policies?
  3. What is an acceptable use policy?
  4. What is a password policy?
  5. What is an access control policy?
  6. What is a data protection policy?
  7. What is a security awareness policy?
  8. Why should employees receive security awareness training?
  9. What is policy enforcement?
  10. What can happen when employees violate security policies?

20.2 Compliance

  1. What is cybersecurity compliance?
  2. Why do organizations need to comply with regulations?
  3. What is GDPR?
  4. What does GDPR protect?
  5. Why is data privacy important?
  6. What is PCI DSS?
  7. What type of data does PCI DSS protect?
  8. What is ISO 27001?
  9. Why are security frameworks useful?
  10. How can compliance requirements affect incident handling?
  11. Why must security incidents sometimes be reported?
  12. What is the difference between a security policy and a compliance requirement?

21.1 Human Factors

  1. Why are humans considered an important cybersecurity factor?
  2. Why do attackers use social engineering?
  3. How can employees identify phishing emails?
  4. What makes a password strong?
  5. Why should passwords not be reused?
  6. Why is password reuse dangerous?
  7. Why should MFA be enabled?
  8. Why should employees avoid unknown USB devices?
  9. Why should sensitive information not be shared unnecessarily?
  10. What is shoulder surfing?
  11. What is tailgating?
  12. How can physical security affect cybersecurity?

22.1 Defense in Depth

  1. What is defense in depth?
  2. Why should organizations use multiple security controls?
  3. What happens if one security control fails?
  4. How can firewalls contribute to defense in depth?
  5. How can endpoint protection contribute to defense in depth?
  6. How can MFA contribute to defense in depth?
  7. How can network segmentation contribute to defense in depth?
  8. How can backups contribute to defense in depth?
  9. How can security awareness contribute to defense in depth?

22.2 Secure Design

  1. What is secure-by-design?
  2. Why should security be considered during system design?
  3. What is attack surface?
  4. How can an organization reduce its attack surface?
  5. Why should unnecessary services be disabled?
  6. Why should unnecessary ports be closed?
  7. Why is network segmentation useful?
  8. Why is least privilege important in secure system design?

Scenario 1 — Phishing

  1. An employee receives a suspicious email. What would you do first?
  2. What indicators would make you suspicious?
  3. How would you investigate the email?
  4. How would you contain the incident?
  5. What would you do if the employee entered their credentials?

Scenario 2 — Ransomware

  1. Several computers suddenly display a ransomware message. What would you do?
  2. What would you isolate first?
  3. What logs would you examine?
  4. How would you determine the scope of the attack?
  5. How would you recover the affected systems?
  6. How could the organization prevent a similar incident?

Scenario 3 — Compromised Account

  1. You detect a login from an unusual country. What questions would you ask?
  2. What logs would you check?
  3. How would you determine whether the login was legitimate?
  4. What actions would you take if the account was compromised?
  5. How could MFA help?

Scenario 4 — Vulnerable Server

  1. A vulnerability scanner reports a critical vulnerability on a public server. What would you do?
  2. How would you assess the risk?
  3. How would you prioritize the vulnerability?
  4. What remediation options would you consider?
  5. What would you do if a patch was not immediately available?

Scenario 5 — Suspicious Network Traffic

  1. A security analyst notices unusual outbound traffic. What could this indicate?
  2. What information would you collect?
  3. Which logs would you examine?
  4. How could you determine whether the traffic is malicious?
  5. When would you escalate the incident?

Scenario 6 — Infected Endpoint

  1. A user's computer starts communicating with an unknown external IP address. What would you do?
  2. What endpoint information would you collect?
  3. Would you disconnect the computer from the network?
  4. What would you investigate next?
  5. How would you restore the endpoint?

24. Comparison Questions

  1. What is the difference between a threat and a vulnerability?
  2. What is the difference between a vulnerability and an exploit?
  3. What is the difference between risk and threat?
  4. What is the difference between authentication and authorization?
  5. What is the difference between encryption and hashing?
  6. What is the difference between symmetric and asymmetric encryption?
  7. What is the difference between AES and RSA?
  8. What is the difference between TCP and UDP?
  9. What is the difference between HTTP and HTTPS?
  10. What is the difference between SSH and Telnet?
  11. What is the difference between a firewall and an IDS?
  12. What is the difference between an IDS and an IPS?
  13. What is the difference between antivirus and EDR?
  14. What is the difference between vulnerability scanning and penetration testing?
  15. What is the difference between an event and an incident?
  16. What is the difference between incident response and disaster recovery?
  17. What is the difference between business continuity and disaster recovery?
  18. What is the difference between a virus and a worm?
  19. What is the difference between phishing and spear phishing?
  20. What is the difference between a public IP address and a private IP address?
  21. What is the difference between a switch and a router?
  22. What is the difference between a hub and a switch?
  23. What is the difference between IPv4 and IPv6?
  24. What is the difference between a vulnerability and a risk?
  25. What is the difference between mitigation and remediation?

25. "Explain It to Me" Questions

  1. Can you explain the CIA triad in your own words?
  2. Can you explain how a phishing attack works?
  3. Can you explain how ransomware works?
  4. Can you explain how a firewall protects a network?
  5. Can you explain how DNS works?
  6. Can you explain how DHCP works?
  7. Can you explain how TCP establishes a connection?
  8. Can you explain how HTTPS protects communication?
  9. Can you explain how MFA improves security?
  10. Can you explain how hashing protects passwords?
  11. Can you explain how vulnerability management works?
  12. Can you explain how risk assessment works?
  13. Can you explain how incident response works?
  14. Can you explain how a SIEM works?
  15. Can you explain how IDS and IPS work?
  16. Can you explain how network segmentation improves security?
  17. Can you explain the principle of least privilege?
  18. Can you explain defense in depth?
  19. Can you explain Zero Trust?
  20. Can you explain the difference between an IOC and a vulnerability?

26. Final Exam-Style Discussion

  1. What is the most important goal of cybersecurity?
  2. How would you protect a small business network?
  3. How would you investigate a suspected phishing attack?
  4. How would you respond to a ransomware infection?
  5. How would you prioritize multiple vulnerabilities?
  6. How would you secure an employee's laptop?
  7. How would you secure a wireless network?
  8. How would you detect suspicious network activity?
  9. How would you respond to a compromised user account?
  10. How would you investigate a security incident?
  11. How would you determine whether an event is a real security incident?
  12. How would you reduce an organization's attack surface?
  13. How would you protect sensitive information?
  14. How would you implement defense in depth?
  15. How would you apply the principle of least privilege?
  16. How would you use threat intelligence during an investigation?
  17. How would you decide whether an incident needs escalation?
  18. How would you recover after a major cyberattack?
  19. What security controls would you recommend for a small organization?
  20. If you were a junior cybersecurity analyst, what would you check first when you received a security alert?