← Back
CCST-160

Cisco 100-160 · Cybersecurity Fragen

Speaking-Fragenkatalog zur CCST-Cybersecurity-Prüfung: CIA-Triade, Kryptografie, Netzwerksicherheit, Endpoint Security, Incident Response, Forensik, Risiko und Compliance.

576 Fragen

1.1 Cybersecurity Fundamentals

  1. What is cybersecurity? →
  2. Why is cybersecurity important for organizations? →
  3. What are the main goals of cybersecurity? →
  4. What is the difference between cybersecurity and information security? →
  5. What is the CIA triad? →
  6. What does confidentiality mean? →
  7. What does integrity mean? →
  8. What does availability mean? →
  9. Can you give an example of a confidentiality violation? →
  10. Can you give an example of an integrity violation? →
  11. Can you give an example of an availability violation? →
  12. Why is the CIA triad important? →
  13. What is authentication? →
  14. What is authorization? →
  15. What is accounting or auditing? →
  16. What is the difference between authentication and authorization? →
  17. What is non-repudiation? →
  18. What is accountability? →
  19. What is the principle of least privilege? →
  20. Why is least privilege important? →
  21. What is defense in depth? →
  22. Why should an organization use multiple layers of security? →
  23. What is Zero Trust? →
  24. What does "never trust, always verify" mean? →
  25. How is Zero Trust different from a traditional security model? →

2.1 Basic Concepts

  1. What is a threat? →
  2. What is a vulnerability? →
  3. What is a risk? →
  4. What is an exploit? →
  5. What is an attack? →
  6. What is an attack vector? →
  7. What is an asset? →
  8. What is a threat actor? →
  9. What is the difference between a threat and a vulnerability? →
  10. How are threats, vulnerabilities and risks related? →
  11. Can a vulnerability exist without being exploited? →
  12. What makes a vulnerability dangerous? →
  13. What is a security weakness? →
  14. What is a zero-day vulnerability? →
  15. Why are zero-day vulnerabilities dangerous? →

2.2 Common Cyberattacks

  1. What is malware? →
  2. What is a virus? →
  3. What is a worm? →
  4. What is a Trojan horse? →
  5. What is ransomware? →
  6. What is spyware? →
  7. What is a rootkit? →
  8. What is a keylogger? →
  9. What is a botnet? →
  10. What is a backdoor? →
  11. What is phishing? →
  12. What is spear phishing? →
  13. What is whaling? →
  14. What is social engineering? →
  15. What is pretexting? →
  16. What is baiting? →
  17. What is tailgating? →
  18. What is credential theft? →
  19. What is password spraying? →
  20. What is brute-force authentication? →
  21. What is credential stuffing? →
  22. What is denial-of-service? →
  23. What is distributed denial-of-service? →
  24. What is a man-in-the-middle attack? →
  25. What is spoofing? →
  26. What is IP spoofing? →
  27. What is DNS spoofing? →
  28. What is session hijacking? →
  29. What is a replay attack? →
  30. What is a privilege escalation attack? →

3.1 Authentication

  1. What is authentication? →
  2. What are the three main authentication factors? →
  3. What is something you know? →
  4. What is something you have? →
  5. What is something you are? →
  6. What is multifactor authentication? →
  7. Why is MFA more secure than a password alone? →
  8. What is biometric authentication? →
  9. What are the advantages of biometric authentication? →
  10. What are the disadvantages of biometric authentication? →
  11. What is single sign-on? →
  12. What are the advantages of SSO? →
  13. What are the risks of SSO? →

3.2 Authorization and Access Control

  1. What is authorization? →
  2. What is access control? →
  3. What is role-based access control? →
  4. What is attribute-based access control? →
  5. What is mandatory access control? →
  6. What is discretionary access control? →
  7. What is the principle of least privilege? →
  8. What is privilege escalation? →
  9. Why should administrator accounts be protected? →
  10. Why should users not have administrator privileges unnecessarily? →
  11. What is account lockout? →
  12. Why can account lockout improve security? →
  13. What problems can excessive account lockout cause? →

4.1 Encryption Fundamentals

  1. What is encryption? →
  2. Why is encryption used? →
  3. What is plaintext? →
  4. What is ciphertext? →
  5. What is a cryptographic key? →
  6. What is symmetric encryption? →
  7. What is asymmetric encryption? →
  8. What is the difference between symmetric and asymmetric encryption? →
  9. What are the advantages of symmetric encryption? →
  10. What are the advantages of asymmetric encryption? →
  11. What is AES? →
  12. What is RSA? →
  13. What is ECC? →
  14. Why is AES commonly used for encrypting large amounts of data? →
  15. Why is asymmetric cryptography useful for key exchange? →
  16. What is a digital certificate? →
  17. What is a public key? →
  18. What is a private key? →
  19. Why must a private key remain secret? →
  20. What is a digital signature? →
  21. What does a digital signature provide? →
  22. What is hashing? →
  23. How is hashing different from encryption? →
  24. What is SHA-256? →
  25. Why are passwords normally stored as hashes rather than plaintext? →
  26. What is salting? →
  27. Why is a salt used when hashing passwords? →
  28. What is TLS? →
  29. How does HTTPS use cryptography? →
  30. What is the difference between HTTP and HTTPS? →

5.1 Network Models

  1. What is a computer network? →
  2. What is the OSI model? →
  3. What are the seven OSI layers? →
  4. What is the purpose of the Physical layer? →
  5. What is the purpose of the Data Link layer? →
  6. What is the purpose of the Network layer? →
  7. What is the purpose of the Transport layer? →
  8. What is the purpose of the Session layer? →
  9. What is the purpose of the Presentation layer? →
  10. What is the purpose of the Application layer? →
  11. What is the TCP/IP model? →
  12. How does the TCP/IP model compare with the OSI model? →
  13. Why is understanding network layers important for cybersecurity? →

5.2 TCP/IP

  1. What is an IP address? →
  2. What is IPv4? →
  3. What is IPv6? →
  4. What is a MAC address? →
  5. What is the difference between an IP address and a MAC address? →
  6. What is a subnet mask? →
  7. What is a default gateway? →
  8. What is a private IP address? →
  9. What is a public IP address? →
  10. What is NAT? →
  11. Why is NAT commonly used? →
  12. What is TCP? →
  13. What is UDP? →
  14. What is the difference between TCP and UDP? →
  15. Why does TCP provide reliable communication? →
  16. What is a TCP three-way handshake? →
  17. What is a TCP port? →
  18. What is an ephemeral port? →
  19. Why are ports important for network security? →
  20. What is ICMP? →

6.1 Common Protocols

  1. What is DNS? →
  2. How does DNS work? →
  3. Why is DNS important? →
  4. What security problems can DNS have? →
  5. What is DNS spoofing? →
  6. What is DHCP? →
  7. How does DHCP work? →
  8. What security risks can DHCP have? →
  9. What is ARP? →
  10. How does ARP work? →
  11. What is ARP spoofing? →
  12. What is HTTP? →
  13. What is HTTPS? →
  14. What is FTP? →
  15. Why is FTP considered insecure? →
  16. What is SFTP? →
  17. What is SSH? →
  18. Why is SSH preferred over Telnet? →
  19. What is Telnet? →
  20. Why is Telnet insecure? →
  21. What is SMTP? →
  22. What is POP3? →
  23. What is IMAP? →
  24. What is SNMP? →
  25. Why should insecure protocols be replaced with secure alternatives? →

7.1 Network Devices

  1. What is a switch? →
  2. What is a router? →
  3. What is a firewall? →
  4. What is a wireless access point? →
  5. What is a modem? →
  6. What is a hub? →
  7. What is the difference between a hub and a switch? →
  8. What is the difference between a switch and a router? →
  9. What is the role of a firewall? →
  10. Where can a firewall be deployed? →
  11. What is a wireless LAN? →
  12. What is a WLAN controller? →
  13. What is network segmentation? →
  14. Why is network segmentation important for security? →
  15. What is a VLAN? →
  16. How can VLANs improve network security? →
  17. What is a DMZ? →
  18. Why would an organization use a DMZ? →

8.1 Secure Wireless Networks

  1. What are the main security risks of wireless networks? →
  2. What is an SSID? →
  3. What is WPA2? →
  4. What is WPA3? →
  5. What is the difference between WPA2 and WPA3? →
  6. What is Wi-Fi encryption? →
  7. Why should WEP not be used? →
  8. What is a strong wireless password? →
  9. Why should the default administrator password be changed? →
  10. Why should wireless firmware be updated? →
  11. What is a guest network? →
  12. Why should guest devices be isolated from internal systems? →
  13. How would you secure a small home or SOHO wireless network? →
  14. What is an evil twin attack? →
  15. How can users protect themselves from rogue wireless networks? →

9.1 Firewalls

  1. What is a firewall? →
  2. What is the purpose of a firewall? →
  3. How does a firewall filter traffic? →
  4. What is a firewall rule? →
  5. What is an allow rule? →
  6. What is a deny rule? →
  7. What is the principle of default deny? →
  8. What is a stateful firewall? →
  9. What is a stateless firewall? →
  10. What is a host-based firewall? →
  11. What is a network firewall? →
  12. What is an application firewall? →
  13. What is a next-generation firewall? →
  14. Why should firewall rules be reviewed regularly? →
  15. What can happen if a firewall rule is too permissive? →

9.2 IDS and IPS

  1. What is an IDS? →
  2. What is an IPS? →
  3. What is the difference between IDS and IPS? →
  4. Where can an IDS be deployed? →
  5. Where can an IPS be deployed? →
  6. What is signature-based detection? →
  7. What is anomaly-based detection? →
  8. What is a false positive? →
  9. What is a false negative? →
  10. Why are false positives a problem? →
  11. Why are false negatives dangerous? →

10.1 Operating System Security

  1. What is endpoint security? →
  2. What is an endpoint? →
  3. Why are endpoints attractive targets for attackers? →
  4. What is endpoint hardening? →
  5. What does a secure operating system configuration look like? →
  6. Why should unnecessary services be disabled? →
  7. Why should unused applications be removed? →
  8. Why are operating system updates important? →
  9. What is a security patch? →
  10. What is patch management? →
  11. Why should endpoint software be kept up to date? →
  12. What is antivirus software? →
  13. What is antimalware software? →
  14. What is EDR? →
  15. What information can endpoint security tools collect? →
  16. What is application allowlisting? →
  17. What is application blocklisting? →
  18. Why is application control useful? →

10.2 Endpoint Security Policies

  1. What is a security baseline? →
  2. What is a security policy? →
  3. What is configuration management? →
  4. Why should endpoint configurations be standardized? →
  5. How can you verify that an endpoint complies with a security policy? →
  6. What should you do if an endpoint violates a security policy? →
  7. Why are software updates important for security? →
  8. Why are hardware updates sometimes necessary for security? →

11.1 Malware Detection and Removal

  1. What is malware? →
  2. How can malware enter an endpoint? →
  3. What is ransomware? →
  4. How does ransomware affect an organization? →
  5. What is a Trojan? →
  6. What is a worm? →
  7. What is spyware? →
  8. What is a rootkit? →
  9. What is a botnet? →
  10. What signs may indicate malware infection? →
  11. What should you do when malware is suspected? →
  12. Why should an infected computer sometimes be isolated from the network? →
  13. Why should malware removal be documented? →
  14. Why should backups be protected against ransomware? →
  15. What is the difference between detecting malware and removing malware? →

12.1 System Logs

  1. What is a log? →
  2. Why are logs important for cybersecurity? →
  3. What information can a security log contain? →
  4. What is an event? →
  5. What is a security event? →
  6. What is a security incident? →
  7. What is the difference between an event and an incident? →
  8. What is log analysis? →
  9. What is centralized logging? →
  10. Why should logs be stored centrally? →
  11. What is a SIEM? →
  12. What does a SIEM do? →
  13. What types of logs can a SIEM collect? →
  14. What is log correlation? →
  15. Why is time synchronization important for log analysis? →
  16. What is a suspicious login event? →
  17. What log information would you examine after a suspected attack? →
  18. When should a security event be escalated? →

13.1 Vulnerability Assessment

  1. What is vulnerability management? →
  2. What is vulnerability assessment? →
  3. What is vulnerability scanning? →
  4. What is a vulnerability scanner? →
  5. What can a vulnerability scanner identify? →
  6. What is the difference between vulnerability scanning and penetration testing? →
  7. What is CVE? →
  8. What is CVSS? →
  9. What does a CVSS score tell you? →
  10. Why should vulnerabilities be prioritized? →
  11. Which vulnerabilities should normally be fixed first? →
  12. What factors should be considered when prioritizing vulnerabilities? →
  13. What is remediation? →
  14. What is mitigation? →
  15. What is a compensating control? →
  16. What is a security baseline? →
  17. Why should vulnerability scans be performed regularly? →
  18. What problems can vulnerability scanners have? →
  19. What is a false positive in vulnerability scanning? →
  20. What is vulnerability remediation management? →

14.1 Risk Fundamentals

  1. What is cybersecurity risk? →
  2. How are threats and vulnerabilities related to risk? →
  3. What is risk assessment? →
  4. What is risk analysis? →
  5. What is qualitative risk analysis? →
  6. What is quantitative risk analysis? →
  7. What is risk likelihood? →
  8. What is risk impact? →
  9. How can an organization prioritize risks? →
  10. What is risk mitigation? →
  11. What is risk avoidance? →
  12. What is risk transfer? →
  13. What is risk acceptance? →
  14. What is a risk register? →
  15. Why should organizations maintain a risk register? →
  16. What is residual risk? →
  17. What is inherent risk? →
  18. What is the difference between inherent and residual risk? →

15.1 Cyber Threat Intelligence

  1. What is threat intelligence? →
  2. Why is threat intelligence important? →
  3. What is an indicator of compromise? →
  4. What is an IOC? →
  5. What can be used as an IOC? →
  6. What is a threat intelligence feed? →
  7. What is a threat intelligence platform? →
  8. What information can threat intelligence provide? →
  9. What is the difference between threat intelligence and a vulnerability scan? →
  10. What is threat hunting? →
  11. How is threat hunting different from incident response? →
  12. What is a threat actor? →
  13. What is an attack technique? →
  14. What is TTP? →
  15. What is MITRE ATT&CK? →
  16. How can MITRE ATT&CK help security analysts? →
  17. How can threat intelligence help identify potential attacks? →

16.1 Incident Handling

  1. What is a cybersecurity incident? →
  2. What is incident response? →
  3. Why is incident response important? →
  4. What are the main phases of incident response? →
  5. What happens during preparation? →
  6. What happens during detection and analysis? →
  7. What happens during containment? →
  8. What happens during eradication? →
  9. What happens during recovery? →
  10. What is the purpose of lessons learned? →
  11. Why should incident response procedures be documented? →
  12. What is an incident response plan? →
  13. What is an incident response playbook? →
  14. What is the difference between a plan and a playbook? →
  15. When should an incident be escalated? →
  16. Who should be involved in incident response? →
  17. Why is documentation important during an incident? →
  18. What information should be recorded during an incident? →
  19. Why should evidence be preserved? →
  20. What mistakes should an incident responder avoid? →

17.1 Phishing Incident

  1. What would you do if an employee reports a suspicious email? →
  2. How would you determine whether an email is phishing? →
  3. What information would you collect? →
  4. How would you contain the incident? →
  5. What would you do if the user clicked the link? →
  6. What would you do if the user entered their password? →
  7. How would you determine whether other users were affected? →

17.2 Malware Incident

  1. What would you do if an endpoint suddenly starts behaving suspiciously? →
  2. How would you determine whether the endpoint is infected? →
  3. When should the endpoint be isolated? →
  4. What evidence should be collected? →
  5. How would you remove the malware? →
  6. How would you verify that the system is clean? →
  7. What should happen after malware removal? →

17.3 Account Compromise

  1. What signs could indicate that an account has been compromised? →
  2. What would you do after detecting suspicious authentication activity? →
  3. How would you contain a compromised account? →
  4. When should a password be reset? →
  5. Why might MFA need to be enabled? →
  6. What logs would you examine? →
  7. How would you determine whether the attacker accessed other systems? →

18.1 Forensic Fundamentals

  1. What is digital forensics? →
  2. Why is digital forensics important after a cyberattack? →
  3. What types of digital evidence can investigators collect? →
  4. What is volatile data? →
  5. What is non-volatile data? →
  6. Why should volatile data sometimes be collected first? →
  7. What is forensic imaging? →
  8. Why should investigators work with copies of evidence? →
  9. What is chain of custody? →
  10. Why is chain of custody important? →
  11. What can system logs reveal during an investigation? →
  12. What can network logs reveal? →
  13. What can endpoint logs reveal? →
  14. What is attack attribution? →
  15. Why can attribution be difficult? →

19.1 Continuity Planning

  1. What is business continuity? →
  2. What is disaster recovery? →
  3. What is the difference between business continuity and disaster recovery? →
  4. Why is disaster recovery important for cybersecurity? →
  5. What is a disaster recovery plan? →
  6. What is a business continuity plan? →
  7. What is a backup? →
  8. Why are backups important against ransomware? →
  9. What is the 3-2-1 backup strategy? →
  10. What is an offline backup? →
  11. What is an immutable backup? →
  12. What is RTO? →
  13. What is RPO? →
  14. What is the difference between RTO and RPO? →
  15. Why should disaster recovery plans be tested? →
  16. What can happen if backups have never been tested? →

20.1 Security Policies

  1. What is a security policy? →
  2. Why do organizations need security policies? →
  3. What is an acceptable use policy? →
  4. What is a password policy? →
  5. What is an access control policy? →
  6. What is a data protection policy? →
  7. What is a security awareness policy? →
  8. Why should employees receive security awareness training? →
  9. What is policy enforcement? →
  10. What can happen when employees violate security policies? →

20.2 Compliance

  1. What is cybersecurity compliance? →
  2. Why do organizations need to comply with regulations? →
  3. What is GDPR? →
  4. What does GDPR protect? →
  5. Why is data privacy important? →
  6. What is PCI DSS? →
  7. What type of data does PCI DSS protect? →
  8. What is ISO 27001? →
  9. Why are security frameworks useful? →
  10. How can compliance requirements affect incident handling? →
  11. Why must security incidents sometimes be reported? →
  12. What is the difference between a security policy and a compliance requirement? →

21.1 Human Factors

  1. Why are humans considered an important cybersecurity factor? →
  2. Why do attackers use social engineering? →
  3. How can employees identify phishing emails? →
  4. What makes a password strong? →
  5. Why should passwords not be reused? →
  6. Why is password reuse dangerous? →
  7. Why should MFA be enabled? →
  8. Why should employees avoid unknown USB devices? →
  9. Why should sensitive information not be shared unnecessarily? →
  10. What is shoulder surfing? →
  11. What is tailgating? →
  12. How can physical security affect cybersecurity? →

22.1 Defense in Depth

  1. What is defense in depth? →
  2. Why should organizations use multiple security controls? →
  3. What happens if one security control fails? →
  4. How can firewalls contribute to defense in depth? →
  5. How can endpoint protection contribute to defense in depth? →
  6. How can MFA contribute to defense in depth? →
  7. How can network segmentation contribute to defense in depth? →
  8. How can backups contribute to defense in depth? →
  9. How can security awareness contribute to defense in depth? →

22.2 Secure Design

  1. What is secure-by-design? →
  2. Why should security be considered during system design? →
  3. What is attack surface? →
  4. How can an organization reduce its attack surface? →
  5. Why should unnecessary services be disabled? →
  6. Why should unnecessary ports be closed? →
  7. Why is network segmentation useful? →
  8. Why is least privilege important in secure system design? →

Scenario 1 — Phishing

  1. An employee receives a suspicious email. What would you do first? →
  2. What indicators would make you suspicious? →
  3. How would you investigate the email? →
  4. How would you contain the incident? →
  5. What would you do if the employee entered their credentials? →

Scenario 2 — Ransomware

  1. Several computers suddenly display a ransomware message. What would you do? →
  2. What would you isolate first? →
  3. What logs would you examine? →
  4. How would you determine the scope of the attack? →
  5. How would you recover the affected systems? →
  6. How could the organization prevent a similar incident? →

Scenario 3 — Compromised Account

  1. You detect a login from an unusual country. What questions would you ask? →
  2. What logs would you check? →
  3. How would you determine whether the login was legitimate? →
  4. What actions would you take if the account was compromised? →
  5. How could MFA help? →

Scenario 4 — Vulnerable Server

  1. A vulnerability scanner reports a critical vulnerability on a public server. What would you do? →
  2. How would you assess the risk? →
  3. How would you prioritize the vulnerability? →
  4. What remediation options would you consider? →
  5. What would you do if a patch was not immediately available? →

Scenario 5 — Suspicious Network Traffic

  1. A security analyst notices unusual outbound traffic. What could this indicate? →
  2. What information would you collect? →
  3. Which logs would you examine? →
  4. How could you determine whether the traffic is malicious? →
  5. When would you escalate the incident? →

Scenario 6 — Infected Endpoint

  1. A user's computer starts communicating with an unknown external IP address. What would you do? →
  2. What endpoint information would you collect? →
  3. Would you disconnect the computer from the network? →
  4. What would you investigate next? →
  5. How would you restore the endpoint? →

24. Comparison Questions

  1. What is the difference between a threat and a vulnerability? →
  2. What is the difference between a vulnerability and an exploit? →
  3. What is the difference between risk and threat? →
  4. What is the difference between authentication and authorization? →
  5. What is the difference between encryption and hashing? →
  6. What is the difference between symmetric and asymmetric encryption? →
  7. What is the difference between AES and RSA? →
  8. What is the difference between TCP and UDP? →
  9. What is the difference between HTTP and HTTPS? →
  10. What is the difference between SSH and Telnet? →
  11. What is the difference between a firewall and an IDS? →
  12. What is the difference between an IDS and an IPS? →
  13. What is the difference between antivirus and EDR? →
  14. What is the difference between vulnerability scanning and penetration testing? →
  15. What is the difference between an event and an incident? →
  16. What is the difference between incident response and disaster recovery? →
  17. What is the difference between business continuity and disaster recovery? →
  18. What is the difference between a virus and a worm? →
  19. What is the difference between phishing and spear phishing? →
  20. What is the difference between a public IP address and a private IP address? →
  21. What is the difference between a switch and a router? →
  22. What is the difference between a hub and a switch? →
  23. What is the difference between IPv4 and IPv6? →
  24. What is the difference between a vulnerability and a risk? →
  25. What is the difference between mitigation and remediation? →

25. "Explain It to Me" Questions

  1. Can you explain the CIA triad in your own words? →
  2. Can you explain how a phishing attack works? →
  3. Can you explain how ransomware works? →
  4. Can you explain how a firewall protects a network? →
  5. Can you explain how DNS works? →
  6. Can you explain how DHCP works? →
  7. Can you explain how TCP establishes a connection? →
  8. Can you explain how HTTPS protects communication? →
  9. Can you explain how MFA improves security? →
  10. Can you explain how hashing protects passwords? →
  11. Can you explain how vulnerability management works? →
  12. Can you explain how risk assessment works? →
  13. Can you explain how incident response works? →
  14. Can you explain how a SIEM works? →
  15. Can you explain how IDS and IPS work? →
  16. Can you explain how network segmentation improves security? →
  17. Can you explain the principle of least privilege? →
  18. Can you explain defense in depth? →
  19. Can you explain Zero Trust? →
  20. Can you explain the difference between an IOC and a vulnerability? →

26. Final Exam-Style Discussion

  1. What is the most important goal of cybersecurity? →
  2. How would you protect a small business network? →
  3. How would you investigate a suspected phishing attack? →
  4. How would you respond to a ransomware infection? →
  5. How would you prioritize multiple vulnerabilities? →
  6. How would you secure an employee's laptop? →
  7. How would you secure a wireless network? →
  8. How would you detect suspicious network activity? →
  9. How would you respond to a compromised user account? →
  10. How would you investigate a security incident? →
  11. How would you determine whether an event is a real security incident? →
  12. How would you reduce an organization's attack surface? →
  13. How would you protect sensitive information? →
  14. How would you implement defense in depth? →
  15. How would you apply the principle of least privilege? →
  16. How would you use threat intelligence during an investigation? →
  17. How would you decide whether an incident needs escalation? →
  18. How would you recover after a major cyberattack? →
  19. What security controls would you recommend for a small organization? →
  20. If you were a junior cybersecurity analyst, what would you check first when you received a security alert? →