A client cannot connect to the corporate web server. You discover a large number of half-open TCP connections to the server.What should you do?
Answer(s): A
The CCST Cybersecurity Study Guide identifies SYN flood attacks as a type of Denial of Service (DoS) attack that exploits the TCP three-way handshake. Attackers send many SYN requests without completing the handshake, leaving the server with numerous half-open connections and exhausting resources."A TCP SYN flood attack overwhelms a target server by initiating a high volume of TCP connections but never completing the handshake, resulting in numerous half-open connections that consume system resources and can render the service unavailable." (CCST Cybersecurity, Incident Handling, Denial-of-Service Attacks section, Cisco Networking Academy)A is correct: The proper action is to stop the SYN flood, often using firewalls, intrusion prevention systems, or SYN cookies.B (switching to HTTPS) does not address the flooding issue. C is incorrect because the excessive number of half-open connections indicates an attack, not normal operation.D (flushing DNS cache) is unrelated to this type of attack.
Which two basic metrics should be taken into consideration when assigning a severity to a vulnerability during an assessment? (Choose 2.)
Answer(s): A,B
The CCST Cybersecurity course describes that risk scoring for vulnerabilities often involves likelihood and impact -- similar to the CVSS (Common Vulnerability Scoring System) model. "When prioritizing vulnerabilities, assess both the likelihood of exploitation and the potential impact to the organization. Likelihood measures how easy or probable it is for an adversary to exploit the weakness, while impact measures the consequences to confidentiality, integrity, and availability if exploitation occurs."(CCST Cybersecurity, Vulnerability Assessment and Risk Management, Risk Assessment and Prioritization section, Cisco Networking Academy)A is correct: Likelihood is a fundamental part of severity assessment. B is correct: Impact determines how damaging an exploit would be. C is incorrect: Time to choose replacement software is an operational consideration, not a severity metric.D is incorrect: Hardware age may influence performance but does not directly define vulnerability severity.
Which Windows app is a command-line interface that includes a sophisticated scripting language used to automate Windows tasks?
The CCST Cybersecurity course identifies Windows PowerShell as both a command-line interface (CLI) and a robust scripting environment. It is used by system administrators for automation, configuration, and task scheduling."PowerShell is a Windows command-line shell and scripting language built on the .NET framework. It allows administrators to automate administrative tasks, manage system configurations, and execute complex scripts for system management."(CCST Cybersecurity, Endpoint Security Concepts, System Administration Tools section, Cisco Networking Academy)A is correct: PowerShell provides both interactive command execution and scripting capabilities. B (MMC) is a GUI-based management console, not a CLI.C (Vim) is a text editor, not a Windows-native CLI.D (MS-DOS) is a legacy command shell with no advanced scripting features comparable to PowerShell.
Why is it necessary to update firmware to the latest version?
Answer(s): C
According to the CCST Cybersecurity Study Guide, firmware updates are a critical security maintenance task because vulnerabilities in firmware can be exploited by attackers to gain persistent control over hardware."Keeping firmware up to date is necessary to patch security vulnerabilities and weaknesses that could be exploited by threat actors. Vendors release firmware updates to correct security flaws, enhance stability, and ensure compatibility with updated security protocols." (CCST Cybersecurity, Endpoint Security Concepts, System and Firmware Maintenance section, Cisco Networking Academy)A is partially true but not the primary security reason for updates. B is incorrect because firmware is not part of the OS kernel; it's embedded in the hardware. C is correct: patching vulnerabilities in firmware is essential for endpoint protection. D may occur as a side benefit, but it's not the main reason from a cybersecurity perspective.
How do threat actors launch ransomware attacks on organizations?
The CCST Cybersecurity course describes ransomware as a form of malicious software that encrypts or locks access to an organization's data, demanding payment for its release. "Ransomware is a type of malware that denies access to data by encrypting it and demands payment from the victim to restore access. Threat actors may deliver ransomware through phishing emails, malicious downloads, or exploiting vulnerabilities in exposed systems." (CCST Cybersecurity, Essential Security Principles, Malware Types and Threats section, Cisco Networking Academy)A describes spyware or information-stealing malware. B is website defacement, which is vandalism, not ransomware. C is correct: locking/encrypting data and demanding payment is the defining behavior of ransomware.D is more aligned with insider threat or espionage activities.
Post your Comments and Discuss Cisco 100-160 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 100-160 content, but please register or login to continue.