This cheat sheet condenses the five Cisco CCST Cybersecurity (100-160) domains into one reference: the CIA triad, core security principles, network and endpoint concepts, malware and social engineering types, risk terms, the incident-handling phases, common ports, and the trap patterns that cost candidates marks. Review it in the last two days before your exam, after you have already worked through practice questions. Unsure whether the exam is right for you? Read is CCST Cybersecurity worth it and CCST Cybersecurity vs Security+.
Exam facts at a glance
- ~35 questions, multiple choice, multiple response, and drag-and-drop matching.
- 50 minutes.
- $125 USD per attempt.
- Passing score: not published; ~70% is the widely cited figure.
- Valid 5 years if earned on or after July 15, 2025 (renew by passing a current exam); earlier CCSTs do not expire.
- Retake wait: a fixed 5 calendar days (beginning the day after a failed attempt) before you can retest the same exam; the full exam fee applies again.
- Pearson VUE test center or Pearson OnVUE online. Closed book. No prerequisites.
- Full exam-format details: CCST Cybersecurity Exam Guide 2026.
The CIA triad
The foundational model behind nearly every domain on the exam. Full walkthrough: The CIA Triad Explained.
| Element | Means | Violated by |
|---|---|---|
| Confidentiality | Only authorized parties can view data | Data breach, unauthorized access |
| Integrity | Data is accurate and unaltered | Tampering, unauthorized modification |
| Availability | Systems and data are accessible when needed | DDoS, ransomware, hardware failure |
Essential security principles
- Least privilege: minimum access necessary to do a job, nothing more.
- Defense in depth: multiple layered controls, so no single failure exposes the whole system. See Principle of Least Privilege and Defense in Depth for how the two work together.
- Separation of duties: splitting a sensitive task across multiple people to prevent fraud or error.
- Zero trust: never automatically trust a device or user, even inside the network perimeter — verify every request.
- Non-repudiation: proof that a specific action was performed by a specific party, so they cannot credibly deny it.
Network security concepts
- Firewall: filters traffic based on rules (source/destination, port, protocol).
- Network segmentation: divides a network into isolated zones so a compromise in one zone cannot freely reach another.
- VPN: encrypts traffic in transit between a device and a network, protecting against eavesdropping on untrusted networks.
- WPA2 / WPA3: wireless security standards; WPA3 is current-generation with stronger encryption and offline password-guessing protection.
- Man-in-the-middle: an attacker secretly intercepts (and possibly alters) communication between two parties.
- DDoS: floods a system with traffic to make it unavailable to legitimate users — an availability attack, not a data-theft attack.
Malware types
The most-tested distinction on the exam — know each by its one defining behavior, not a general description.
| Type | Defining behavior |
|---|---|
| Virus | Attaches to a host file; needs user action (opening the file) to spread. |
| Worm | Self-replicates across a network without needing a host file or user action. |
| Trojan | Disguised as legitimate software to trick a user into installing it. |
| Ransomware | Encrypts victim data and demands payment for the decryption key. |
| Spyware | Covertly collects information without the victim's knowledge. |
Social engineering types
- Phishing: broad, untargeted deceptive emails aiming to steal credentials or install malware.
- Spear phishing: targeted phishing aimed at a specific individual or organization.
- Business email compromise (BEC): impersonating an executive or trusted party, often to request a wire transfer or sensitive data.
- Pretexting: fabricating a scenario or false identity to extract information.
Endpoint hardening basics
- Patch management: promptly applying security updates to close known vulnerabilities.
- Disabling unnecessary services/ports: reduces the attack surface by removing unused entry points.
- Endpoint protection platforms (EPP/EDR): antivirus and behavior-based detection on individual devices.
- Secure configuration baselines: a documented, vetted default configuration applied consistently across devices.
Risk management formula
Risk = Likelihood × Impact. A critical vulnerability on a low-value, low-traffic system is not automatically "high risk" — likelihood and impact both matter, not the severity label alone. Vulnerability = a weakness that could be exploited. Threat = something capable of exploiting that weakness. Risk = the combination of the two, weighed by potential impact.
Incident-handling phases
Know the order — questions test which phase a described action belongs to, not just each phase's definition in isolation.
- Preparation — building the plans, tools, and team readiness before an incident occurs.
- Detection and analysis — identifying that an incident is happening and scoping it.
- Containment — stopping the threat from spreading further (for example, isolating an affected system from the network).
- Eradication — removing the actual cause (malware, unauthorized access) from the environment.
- Recovery — restoring systems to normal operation.
- Post-incident review — documenting lessons learned to prevent recurrence.
Common port numbers
| Protocol | Port |
|---|---|
| HTTP / HTTPS | 80 / 443 |
| SSH | 22 |
| Telnet (insecure, unencrypted) | 23 |
| DNS | 53 |
| DHCP (server/client) | 67 / 68 |
| RDP | 3389 |
Exam tell: Telnet (port 23) sends data unencrypted, including credentials — SSH (port 22) is the secure replacement. A question that asks which protocol is safe to use for remote administration is testing this exact distinction.
Abbreviations glossary
| Abbreviation | Meaning |
|---|---|
| CIA | Confidentiality, Integrity, Availability — the three pillars of information security. |
| AAA | Authentication, Authorization, Accounting — verifying identity, controlling access, logging activity. |
| MFA | Multi-Factor Authentication — requiring two or more independent proof-of-identity factors. |
| VPN | Virtual Private Network — encrypts traffic between a device and a network over an untrusted path. |
| DDoS | Distributed Denial of Service — floods a system with traffic from many sources to make it unavailable. |
| EDR | Endpoint Detection and Response — behavior-based monitoring and response on individual devices. |
| BEC | Business Email Compromise — impersonating a trusted party by email, often to request a fraudulent transfer. |
| CVSS | Common Vulnerability Scoring System — a standardized severity score for a known vulnerability. |
| SOC | Security Operations Center — the team and function responsible for monitoring and responding to security events. |
| IDS / IPS | Intrusion Detection System / Intrusion Prevention System — detects (IDS) or actively blocks (IPS) malicious traffic. |
Top 5 trap-question patterns
- “Which CIA element is violated?” — a data breach is confidentiality, tampering is integrity, an outage is availability. Read for which one the scenario actually describes.
- Confusing worm and virus — a worm self-replicates without a host file or user action; a virus needs both. This distinction is tested repeatedly.
- Treating every "critical" vulnerability as automatically high risk — risk requires weighing likelihood and impact together, not the severity label alone.
- Naming the wrong incident-handling phase — isolating a system is containment, not eradication; removing the malware is eradication, not containment.
- Reading "select TWO" as "select the best ONE" — multiple-response items require every correct option; there is no partial credit.
Detailed explanations in How to Pass CCST Cybersecurity on the First Try.
Exam-day pocket guide
- ~35 questions, 50 minutes — under 90 seconds per question on average, but no simulation items to eat extra time.
- "Select TWO/THREE" questions: read the stem twice, no partial credit.
- Every scenario question is really asking "which principle/control/attack type does this describe" — think in that frame first.
- Passing score is unpublished — do not try to count your correct answers during the exam.
- If frozen on a question past 90 seconds: flag, move on, return at the end.
- There is no penalty for wrong answers — never leave a question blank.
What to memorize first if you are short on time
- The CIA triad and what damages each property. Ransomware and DDoS hit availability, tampering hits integrity, data leaks hit confidentiality.
- Malware by behavior. Self-spreading without a host is a worm, disguised software is a trojan, encrypt-and-demand-payment is ransomware, covert data collection is spyware.
- Incident-handling order. Preparation, detection and analysis, containment, eradication, recovery, post-incident review.
- Vulnerability, threat, risk. Weakness, something that can exploit it, and likelihood combined with impact.
- What each control is for. Segmentation limits lateral movement, a firewall filters traffic, a VPN protects traffic in transit, patching closes known weaknesses, least privilege limits blast radius.
Once those five feel automatic, test them with the 10 free CCST Cybersecurity practice questions or the full 4-week study plan.
Frequently asked questions
Can I use this cheat sheet during the CCST Cybersecurity exam?
No. 100-160 is closed book under proctored conditions, whether you sit it at a Pearson VUE test center or online via Pearson OnVUE — you cannot bring notes, a printed reference, a second monitor, or any external material into the exam session itself, and OnVUE’s pre-exam room scan is specifically designed to catch anything like this on your desk. Use this cheat sheet as a review and memorization tool before the exam, not as something to consult mid-exam. The most effective way to use it is to read it end-to-end once early in your study period to preview scope, reference individual sections as you cover each domain, and read it again in full during the final 48 hours before your exam date.
Is there a printable PDF of the CCST Cybersecurity cheat sheet?
A dedicated printable PDF version is coming soon. For now, your browser’s built-in print function (Ctrl+P on Windows, Cmd+P on Mac) with the destination set to "save as PDF" preserves the tables and formatting far better than copying the text into a separate document. Whatever you print is for pre-exam review only — none of it can accompany you into the actual proctored exam session.
What is the single most important section to memorize?
The CIA triad and the malware types table, in that order. Nearly every domain’s reasoning traces back to the CIA triad, even in questions that are not explicitly "about" it — a network security or incident-handling scenario can just as easily hinge on identifying which element of confidentiality, integrity, or availability is at stake as a Domain 1 question can. The malware types table matters because precise recognition of behavior (encrypts and demands payment vs self-replicates without a host vs disguised as legitimate software) is the most commonly tested distinction in Endpoint Security Concepts, the largest single domain on the exam. If your study time before exam day is genuinely limited, drilling these two sections until they are automatic will move your score more than any other single hour of review.
What should I memorize first for CCST Cybersecurity?
Start with the CIA triad, then the malware behavior table, then the six incident-handling phases in order. Those three items support the most questions across the five domains. After that, learn the difference between a vulnerability, a threat, and a risk, and the purpose of segmentation, firewalls, and VPNs. Finish with the trap-pattern list so you recognize how questions are worded.
Is the CCST Cybersecurity cheat sheet enough to pass?
On its own, rarely. A cheat sheet compresses what you should already understand; the exam asks you to apply principles to short scenarios, which only practice builds. Use this page for the final 48 hours after you are scoring around 80 percent on practice questions, and keep drilling scenarios alongside it.
Does this cheat sheet cover everything on the exam?
No, and it is not meant to. It covers the high-yield reference material — the CIA triad, security principles, malware types, incident-handling phases, common ports, and the trap-question patterns that repeatedly catch first-time candidates. It is deliberately a compression for final review, not a substitute for a structured study plan or the depth of the full CertSharp question bank. Pair this page with the full CertSharp CCST Cybersecurity question bank for a complete study plan, not as a replacement for it.
Sources
- Cisco: CCST Cybersecurity exam page
- Cisco Learning Network: CCST Cybersecurity exam topics
- CompTIA: Security+ certification page
Cisco does not publish an exact passing score or question count for 100-160; those figures are widely reported estimates.
Pair the cheat sheet with practice
The cheat sheet is for review. The CertSharp question bank is for testing whether you have actually internalized it. 30 free questions, no signup. $11.99 lifetime for the full 500.