How to use these questions
Answer each question before revealing the explanation below it — resist the urge to peek. These 10 questions are drawn from all five 100-160 domains, weighted roughly to their real exam proportions. For the full exam-format breakdown, see the CCST Cybersecurity Exam Guide 2026. For a structured plan to close any gaps these questions reveal, see the 4-week study plan.
The 10 questions
An organization wants to ensure that if one employee’s account is compromised, the attacker can only access the specific files that employee needs for their job, nothing more. Which security principle does this describe?
- A.Defense in depth
- B.Least privilegeCorrect
- C.Security through obscurity
- D.Non-repudiation
Explanation
Least privilege grants each user only the minimum access needed to do their job, directly limiting the blast radius of a compromised account. Defense in depth layers multiple controls but is a broader strategy, not specifically about access scoping. Security through obscurity relies on hiding details rather than restricting access, and is not considered a sound control on its own.
Which element of the CIA triad is violated when a website is taken offline by a distributed denial-of-service (DDoS) attack, even though no data is stolen or altered?
- A.Confidentiality
- B.Integrity
- C.AvailabilityCorrect
- D.Authentication
Explanation
Availability ensures systems and data are accessible to authorized users when needed. A DDoS attack does not steal data (confidentiality) or alter it (integrity) — it simply overwhelms the system so legitimate users cannot reach it, which is squarely an availability violation. Authentication is not one of the three CIA triad elements.
A company wants to separate its guest Wi-Fi network from its internal corporate network so guest devices cannot reach internal file servers, even if a guest device is compromised. Which concept accomplishes this?
- A.Network segmentationCorrect
- B.Port forwarding
- C.Network address translation (NAT)
- D.Dynamic DNS
Explanation
Network segmentation divides a network into isolated zones so that traffic (and a potential compromise) in one zone cannot freely reach another — exactly what separates guest Wi-Fi from internal corporate resources. NAT translates addresses for internet access but does not by itself enforce isolation between two internal zones.
Which of the following best describes what a VPN (Virtual Private Network) protects against when an employee connects to corporate resources from a coffee shop’s public Wi-Fi?
- A.It prevents malware from being installed on the employee’s laptop
- B.It encrypts traffic between the employee’s device and the corporate network, preventing eavesdropping on the public networkCorrect
- C.It blocks all incoming connection attempts to the laptop
- D.It verifies the employee’s identity using biometric authentication
Explanation
A VPN creates an encrypted tunnel between the device and the corporate network, protecting the traffic in transit from eavesdropping on an untrusted network like public Wi-Fi. It does not scan for or prevent malware, does not function as a host firewall blocking inbound connections, and has no inherent connection to biometric authentication.
A type of malware encrypts a victim’s files and demands payment for the decryption key. Which type of malware is this?
- A.Worm
- B.Trojan
- C.RansomwareCorrect
- D.Spyware
Explanation
Ransomware specifically encrypts victim data and demands payment (a ransom) for the decryption key. A worm self-replicates across a network without needing a host file; a trojan disguises itself as legitimate software; spyware covertly collects information without the victim’s knowledge — none of these describe the encrypt-and-demand-payment behavior in the question.
Select TWO practices that directly reduce an endpoint’s attack surface. (Choose two.)
- A.Disabling unnecessary services and ports on the deviceCorrect
- B.Increasing the number of local administrator accounts for convenience
- C.Applying security patches promptly after releaseCorrect
- D.Disabling the endpoint’s firewall to improve network speed
Explanation
Disabling unnecessary services and ports removes potential entry points an attacker could exploit, and prompt patching closes known vulnerabilities before they can be used against the device — both directly shrink the attack surface. Adding more administrator accounts and disabling the local firewall both increase risk rather than reduce it.
An employee receives an email that appears to be from their company’s CEO, urgently requesting a wire transfer, with subtle spelling errors in the sender’s domain name. What is this an example of?
- A.A brute-force attack
- B.A business email compromise (BEC) / phishing attemptCorrect
- C.A denial-of-service attack
- D.A man-in-the-middle attack
Explanation
This is a classic business email compromise (a targeted form of phishing) — impersonating an executive, creating urgency, and using a slightly misspelled domain to appear legitimate. A brute-force attack involves repeated login attempts; a denial-of-service attack floods a system to make it unavailable; a man-in-the-middle attack intercepts communications between two parties, none of which match this scenario.
A vulnerability scan identifies a critical flaw in a public-facing web server, but the server hosts a rarely used internal tool with no sensitive data and minimal traffic. How should risk be assessed in this case?
- A.Risk is always high whenever a critical vulnerability is found, regardless of context
- B.Risk should consider both the likelihood of exploitation and the potential impact, which may be lower here given minimal data and trafficCorrect
- C.Risk should be ignored since the vulnerability scanner already rated it critical
- D.Risk only matters for internet-facing systems that process payment data
Explanation
Risk is a function of both likelihood and impact, not severity rating alone — a critical vulnerability on a low-value, low-traffic system may still warrant a lower risk priority than a moderate vulnerability on a high-value system, though it should still be remediated. Treating every "critical" label as automatically high risk ignores the impact side of the equation entirely.
Which of the following is the best definition of a "vulnerability" in a security context?
- A.An attacker actively exploiting a system
- B.A weakness in a system that could be exploited by a threatCorrect
- C.The financial cost of a security incident
- D.A completed security audit report
Explanation
A vulnerability is a weakness or gap that could be exploited by a threat — it exists whether or not it is ever actually exploited. An attacker actively exploiting a system describes an attack or incident, not the vulnerability itself; financial cost and audit reports are unrelated concepts entirely.
During a security incident, an organization isolates the affected systems from the network to stop the threat from spreading further, before removing the malware. Which incident handling phase does this describe?
- A.Preparation
- B.Detection and analysis
- C.ContainmentCorrect
- D.Post-incident review
Explanation
Containment focuses on stopping the threat from spreading further, such as isolating affected systems from the network, before moving on to eradication (removing the malware) and recovery. Preparation happens before an incident occurs; detection and analysis identifies and scopes the incident; post-incident review happens after the incident is fully resolved.
Scoring guide
| Score | What it suggests |
|---|---|
| 9-10 correct | You are likely close to exam-ready. Move on to full-length timed mocks. |
| 7-8 correct | Solid foundation with specific gaps. Review the domains you missed. |
| Under 7 correct | Plan for another 1-2 weeks of structured study before your next practice checkpoint. |
What to do next
These 10 questions are a sample. The full CertSharp CCST Cybersecurity bank has 500 questions across all five domains, with an explanation on every one — enough depth to build real pattern recognition rather than memorizing 10 specific answers. Try 30 more free questions, or read the CCST Cybersecurity cheat sheet for a fast final review.
Frequently asked questions
Are these real Cisco exam questions?
No. These are original practice questions written to mirror the style, difficulty, and domain weighting of the real 100-160 exam, mapped to Cisco’s published exam topics. Cisco does not release retired exam questions, and using leaked or braindump content violates the Cisco certification agreement.
How representative are these of the real exam difficulty?
These 10 sample questions span the full range of the entry-level format: definitional recall, scenario-to-principle matching, and one multiple-response item. CCST Cybersecurity has no simulation-style items, so multiple-choice and multiple-response practice is directly representative of the real exam’s format, unlike a hands-on exam such as CCNA. The full 500-question CertSharp bank is calibrated slightly above real exam difficulty, so consistent 80%+ performance there predicts a comfortable pass.
Which domain should I focus my practice on most?
Weight your practice roughly to the exam: Endpoint Security Concepts (26%) and Basic Network Security Concepts (22%) should get the most questions in your rotation — together they are nearly half the scored content. Essential Security Principles (17%) matters disproportionately more than its weight suggests, since its concepts underpin how you reason through the other four domains.
I got several of these wrong — does that mean I will fail?
Not necessarily, but treat it as a signal. Missing 3+ of these 10 suggests you need another 1-2 weeks of domain-specific study before booking. Review every explanation below, not just for the questions you missed — the distractor explanations often teach a second related fact.
Get 30 free questions right now
No signup for the first 30. Full 500-question bank is $11.99 lifetime, or $9.99/month Pro unlocks CCST Cybersecurity plus every other CertSharp certification.