Cisco CCST Cybersecurity Cheat Sheet 2026 — All 5 Domains

Exam facts at a glance

• ~35 questions, multiple choice, multiple response, and drag-and-drop matching.
• 50 minutes.
• $125 USD per attempt.
• Passing score: not published; ~70% is the widely cited figure.
• Valid 3 years.
• Retake wait: 5 / 30 / 45 / 180 calendar days, escalating with each failed attempt.
• Pearson VUE test center or Pearson OnVUE online. Closed book. No prerequisites.
• Full exam-format details: CCST Cybersecurity Exam Guide 2026.

The CIA triad

The foundational model behind nearly every domain on the exam. Full walkthrough: The CIA Triad Explained.

Essential security principles

• Least privilege: minimum access necessary to do a job, nothing more.
• Defense in depth: multiple layered controls, so no single failure exposes the whole system.
• Separation of duties: splitting a sensitive task across multiple people to prevent fraud or error.
• Zero trust: never automatically trust a device or user, even inside the network perimeter — verify every request.
• Non-repudiation: proof that a specific action was performed by a specific party, so they cannot credibly deny it.

Network security concepts

• Firewall: filters traffic based on rules (source/destination, port, protocol).
• Network segmentation: divides a network into isolated zones so a compromise in one zone cannot freely reach another.
• VPN: encrypts traffic in transit between a device and a network, protecting against eavesdropping on untrusted networks.
• WPA2 / WPA3: wireless security standards; WPA3 is current-generation with stronger encryption and offline password-guessing protection.
• Man-in-the-middle: an attacker secretly intercepts (and possibly alters) communication between two parties.
• DDoS: floods a system with traffic to make it unavailable to legitimate users — an availability attack, not a data-theft attack.

Malware types

The most-tested distinction on the exam — know each by its one defining behavior, not a general description.

Social engineering types

• Phishing: broad, untargeted deceptive emails aiming to steal credentials or install malware.
• Spear phishing: targeted phishing aimed at a specific individual or organization.
• Business email compromise (BEC): impersonating an executive or trusted party, often to request a wire transfer or sensitive data.
• Pretexting: fabricating a scenario or false identity to extract information.

Endpoint hardening basics

• Patch management: promptly applying security updates to close known vulnerabilities.
• Disabling unnecessary services/ports: reduces the attack surface by removing unused entry points.
• Endpoint protection platforms (EPP/EDR): antivirus and behavior-based detection on individual devices.
• Secure configuration baselines: a documented, vetted default configuration applied consistently across devices.

Risk management formula

Risk = Likelihood × Impact. A critical vulnerability on a low-value, low-traffic system is not automatically "high risk" — likelihood and impact both matter, not the severity label alone. Vulnerability = a weakness that could be exploited. Threat = something capable of exploiting that weakness. Risk = the combination of the two, weighed by potential impact.

Incident-handling phases

Know the order — questions test which phase a described action belongs to, not just each phase's definition in isolation.

1. Preparation — building the plans, tools, and team readiness before an incident occurs.
2. Detection and analysis — identifying that an incident is happening and scoping it.
3. Containment — stopping the threat from spreading further (for example, isolating an affected system from the network).
4. Eradication — removing the actual cause (malware, unauthorized access) from the environment.
5. Recovery — restoring systems to normal operation.
6. Post-incident review — documenting lessons learned to prevent recurrence.

Common port numbers

Exam tell: Telnet (port 23) sends data unencrypted, including credentials — SSH (port 22) is the secure replacement. A question that asks which protocol is safe to use for remote administration is testing this exact distinction.

Abbreviations glossary

Top 5 trap-question patterns

1. “Which CIA element is violated?” — a data breach is confidentiality, tampering is integrity, an outage is availability. Read for which one the scenario actually describes.
2. Confusing worm and virus — a worm self-replicates without a host file or user action; a virus needs both. This distinction is tested repeatedly.
3. Treating every "critical" vulnerability as automatically high risk — risk requires weighing likelihood and impact together, not the severity label alone.
4. Naming the wrong incident-handling phase — isolating a system is containment, not eradication; removing the malware is eradication, not containment.
5. Reading "select TWO" as "select the best ONE" — multiple-response items require every correct option; there is no partial credit.

Detailed explanations in How to Pass CCST Cybersecurity on the First Try.

Exam-day pocket guide

• ~35 questions, 50 minutes — under 90 seconds per question on average, but no simulation items to eat extra time.
• "Select TWO/THREE" questions: read the stem twice, no partial credit.
• Every scenario question is really asking "which principle/control/attack type does this describe" — think in that frame first.
• Passing score is unpublished — do not try to count your correct answers during the exam.
• If frozen on a question past 90 seconds: flag, move on, return at the end.
• There is no penalty for wrong answers — never leave a question blank.

Frequently asked questions