I85PREP
⌘ K
CCST Cybersecurity study materials
CCST Cybersecurity study resources

CCST Cybersecurity practice questions

One question at a time. Build your CCST Cybersecurity understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Essential Security Principles

Which security principle is directly violated when an unauthorized employee reads a confidential HR salary spreadsheet?

  1. Integrity
  2. Confidentiality Correct answer.
  3. Availability
  4. Non-repudiation

Explanation

Confidentiality means information is disclosed only to authorized parties. Reading salary data without authorization is an unauthorized disclosure, so confidentiality is the property that fails. Integrity concerns unauthorized modification, and availability concerns timely access.

Question 2Essential Security Principles

A file server's records are silently altered by malware so totals no longer match the source documents. Which part of the CIA triad is primarily affected?

  1. Availability
  2. Authentication
  3. Integrity Correct answer.
  4. Confidentiality

Explanation

Integrity refers to data remaining accurate and unaltered except through authorized changes. Silent modification of records breaks that guarantee. Availability would involve loss of access, and confidentiality would involve unauthorized disclosure.

Question 3Essential Security Principles

A help-desk technician needs to reset passwords only during business hours. Which principle best supports granting only the rights required for that task?

  1. Job rotation
  2. Separation of duties
  3. Mandatory vacation
  4. Least privilege Correct answer.

Explanation

Least privilege means each account receives only the access needed to perform its assigned duties, for only as long as needed. Limiting the technician to password resets is a direct application of that principle. Separation of duties and job rotation limit fraud risk rather than scoping permissions.

Question 4Essential Security Principles

A user logs in with a password plus a one-time code from an authenticator app. Which authentication factor category does the code represent?

  1. Something you know
  2. Something you have Correct answer.
  3. Something you are
  4. Somewhere you are

Explanation

Authentication factors fall into categories such as knowledge, possession, inherence, and location. A one-time code generated by an app on a device the user possesses is a possession factor. The password supplies the knowledge factor.

Question 5Essential Security Principles

Which malware type encrypts a victim's files and demands payment for the decryption key?

  1. Ransomware Correct answer.
  2. Worm
  3. Keylogger
  4. Rootkit

Explanation

Ransomware encrypts or otherwise locks data and demands payment for restoration. Rootkits hide attacker presence, keyloggers capture keystrokes, and worms self-propagate across networks.

Question 6Essential Security Principles

An email claims to be from the IT department and asks employees to confirm their credentials on a linked page. What attack is this?

  1. Phishing Correct answer.
  2. Shoulder surfing
  3. Vishing
  4. Tailgating

Explanation

Phishing uses fraudulent messages, often email, that impersonate a trusted party to trick recipients into revealing information. Vishing is the voice-call equivalent, while tailgating and shoulder surfing are physical attacks.

Question 7Essential Security Principles

Which of the following is a preventive security control?

  1. A badge-reader door lock Correct answer.
  2. Writing an incident post-mortem report
  3. Reviewing audit logs for anomalies
  4. Receiving an intrusion detection alert

Explanation

Preventive controls stop an event before it occurs, such as a lock that denies entry without valid credentials. Log review and IDS alerts are detective, and a post-mortem is a corrective or learning activity.

Question 8Essential Security Principles

Which practice most improves resistance to offline password guessing?

  1. Reusing one strong password on all sites
  2. Adding the company name plus a number
  3. Using a long unique passphrase Correct answer.
  4. Forcing a 30-day password reset cycle

Explanation

Guessing resistance grows with password length and unpredictability, so a long unique passphrase is strongest. Frequent forced resets tend to produce weaker, predictable variations, and reuse lets one breach compromise many accounts.

Question 9Essential Security Principles

A laptop with unpatched software that could be exploited sits in an unlocked office. In risk terms, the unpatched software is best described as:

  1. A threat
  2. An asset
  3. A vulnerability Correct answer.
  4. A risk

Explanation

A vulnerability is a weakness that a threat could exploit, such as missing patches. The laptop is the asset, a potential attacker is the threat, and risk is the combination of likelihood and impact.

Question 10Essential Security Principles

A company places a firewall at the perimeter, endpoint antivirus on hosts, and requires MFA for remote access. Which concept does this illustrate?

  1. Defense in depth Correct answer.
  2. Single sign-on
  3. Security through obscurity
  4. Least privilege

Explanation

Defense in depth layers multiple independent controls so that one failure does not expose the whole environment. Combining network, host, and identity controls is the classic example. Single sign-on and least privilege address access convenience and permission scope, not layered protection.

Question 11Essential Security Principles

Which property distinguishes a cryptographic hash from encryption?

  1. Hashes are reversible with the correct key
  2. Hashes require a shared secret key
  3. Hashes produce variable-length output
  4. Hashes are one-way and cannot be reversed Correct answer.

Explanation

A hash is a one-way function: it produces a fixed-length digest from input, and the input cannot be recovered from the digest. Encryption is reversible with the right key, and hashing does not require a key at all for standard algorithms.

Question 12Essential Security Principles

A digital signature on an email primarily provides which two guarantees?

  1. Compression and encoding
  2. Anonymity and deniability
  3. Confidentiality and availability
  4. Integrity and authenticity Correct answer.

Explanation

A digital signature lets the recipient verify that the message was not altered and that it came from the holder of the signing key. It does not by itself hide the content, so confidentiality requires separate encryption.

Question 13Essential Security Principles

An organization assigns permissions to job roles and then places users into those roles. Which access control model is this?

  1. Discretionary access control
  2. Mandatory access control
  3. Rule-based access control
  4. Role-based access control Correct answer.

Explanation

Role-based access control grants rights to roles rather than to individuals, and users inherit permissions through role membership. Discretionary control lets owners set permissions, while mandatory control relies on system-enforced labels.

Question 14Essential Security Principles

The employee who creates vendor payments is not allowed to approve them. Which principle is applied?

  1. Job rotation
  2. Separation of duties Correct answer.
  3. Need to know
  4. Least privilege

Explanation

Separation of duties divides a sensitive process among different people so no single person can complete it alone. Requiring a second approver for payments is a standard example. Least privilege scopes permissions, and need to know limits data access.

Question 15Essential Security Principles

A backup plan runs a full backup on Sunday and then backs up only data changed since that full backup on each following day. What type of backup is this?

  1. Differential backup Correct answer.
  2. Snapshot backup
  3. Mirror backup
  4. Incremental backup

Explanation

A differential backup captures everything changed since the last full backup, so each day's set grows until the next full run. An incremental backup captures only changes since the most recent backup of any kind.

Question 16Essential Security Principles

Which incident response phase immediately follows detection and analysis?

  1. Lessons learned
  2. Recovery
  3. Preparation
  4. Containment, eradication, and recovery Correct answer.

Explanation

Standard incident response ordering moves from preparation to detection and analysis, then to containment, eradication, and recovery. Post-incident lessons learned come after recovery.

Question 17Essential Security Principles

In the AAA framework, which component logs user activity such as login times and resources accessed?

  1. Federation
  2. Authentication
  3. Authorization
  4. Accounting Correct answer.

Explanation

AAA consists of authentication, authorization, and accounting. Accounting records what an authenticated user did, when, and for how long. Authentication proves identity and authorization decides what is permitted.

Question 18Essential Security Principles

Which action most directly reduces the risk of employees falling for phishing emails?

  1. Shortening password expiry to 30 days
  2. Blocking all inbound email attachments
  3. Regular phishing simulations and awareness training Correct answer.
  4. Increasing mailbox storage quotas

Explanation

Awareness training teaches employees to recognize suspicious messages, and simulations measure and reinforce that skill. Storage quotas and password expiry do not affect phishing susceptibility, and blocking all attachments is overly broad and easily bypassed by links.

Question 19Essential Security Principles

Which activity best reduces exposure to known software exploits on production servers?

  1. Increasing minimum password length to 20 characters
  2. Reviewing firewall rules quarterly
  3. Rotating backups more often
  4. Applying vendor security patches promptly Correct answer.

Explanation

Known exploits usually target publicly documented flaws, so prompt patching removes the weakness the exploit depends on. Backups aid recovery after an event but do not close the exposure itself.

Question 20Essential Security Principles

Which statement best describes a zero trust approach?

  1. Remote users must use a hardware token only
  2. Access is decided per request using identity and device context Correct answer.
  3. All internal traffic is exempt from inspection
  4. Trust is granted once a user is inside the corporate network

Explanation

Zero trust removes implicit trust based on network location and evaluates every request using identity, device health, and context. Being on the internal network does not by itself grant access. This contrasts with traditional perimeter models.

Question 21Essential Security Principles

A sender later denies having authorized a transaction. Which security service prevents this denial?

  1. Non-repudiation Correct answer.
  2. Anonymization
  3. Availability
  4. Confidentiality

Explanation

Non-repudiation provides evidence, typically through digital signatures and reliable logging, that a specific party performed an action. It prevents a party from credibly denying that action later. Confidentiality and availability address disclosure and access, not proof of action.

Question 22Essential Security Principles

In which access control model does the system enforce labels such as Top Secret and Confidential regardless of the data owner's wishes?

  1. Role-based access control
  2. Attribute-based access control
  3. Mandatory access control Correct answer.
  4. Discretionary access control

Explanation

Mandatory access control assigns sensitivity labels to objects and clearances to subjects, and the system enforces the rules. Owners cannot override the policy. Discretionary control, by contrast, lets owners set access themselves.

Question 23Essential Security Principles

A system has an RTO of 4 hours and an RPO of 15 minutes. What does the RPO specify?

  1. The interval between scheduled full backups
  2. The time needed to restore from tape
  3. The maximum time the system may be down
  4. The maximum acceptable data loss measured in time Correct answer.

Explanation

Recovery point objective defines how much data loss, expressed as time, is tolerable, which drives backup frequency. Recovery time objective defines how quickly service must be restored. The two are related but measure different things.

Question 24Essential Security Principles

A team maps entry points, data flows, and trust boundaries of a new web application before release. Which activity are they performing?

  1. Vulnerability scanning
  2. Threat modeling Correct answer.
  3. Penetration testing
  4. Security awareness training

Explanation

Threat modeling is a design-time exercise that diagrams components, data flows, and trust boundaries to identify where threats could apply. Penetration testing and scanning are testing activities performed against a built system.

Question 25Essential Security Principles

Which control is most appropriate for data labeled 'Confidential' that must be shared with an external partner?

  1. Sending it in clear text to simplify processing
  2. Storing it on unlabeled removable media
  3. Encrypting it in transit and at rest with access limited to named recipients Correct answer.
  4. Posting it to a public share link for convenience

Explanation

Confidential data requires protection proportionate to its sensitivity, including encryption in transit and at rest and restricted access. Sharing with named recipients preserves the need-to-know principle. Convenience measures that widen exposure violate the classification's handling requirements.

Question 26Essential Security Principles

Which security objective is concerned with preventing unauthorized disclosure of information?

  1. Integrity
  2. Availability
  3. Non-repudiation
  4. Confidentiality Correct answer.

Explanation

Confidentiality means information is disclosed only to authorized parties, so it is the objective that guards against unauthorized disclosure. Integrity guards against improper modification, availability guards against loss of timely access, and non-repudiation prevents a party from denying an action it performed.

Question 27Essential Security Principles

A hardware token that generates one-time codes is an example of which authentication factor category?

  1. Somewhere you are
  2. Something you know
  3. Something you have Correct answer.
  4. Something you are

Explanation

Authentication factors fall into categories such as knowledge, possession, and inherence. A token generates codes from a secret stored inside the device itself, so it is a possession factor regardless of how the code is used.

Question 28Essential Security Principles

Which type of malware spreads across networks by exploiting vulnerable services without any user action?

  1. A virus
  2. A worm Correct answer.
  3. A trojan
  4. A logic bomb

Explanation

A worm is self-contained code that propagates by exploiting network services, so it needs no user to run it. The other categories depend on a host file, on user deception, or on a trigger condition.

Question 29Essential Security Principles

A firewall is configured so that any packet not explicitly matched by an allow rule is dropped. Which principle does this implement?

  1. Defense in depth
  2. Separation of duties
  3. Least privilege
  4. Implicit deny Correct answer.

Explanation

An implicit deny rule closes a rule set by blocking everything that is not specifically permitted, producing a default-deny posture. The other options describe permission scoping, task splitting, and layered controls rather than default packet handling.

Question 30Essential Security Principles

An organization applies a set of controls to a system and then measures the risk that still remains. What is this remaining risk called?

  1. Risk appetite
  2. Inherent risk
  3. Residual risk Correct answer.
  4. Risk transference

Explanation

Residual risk is what is left over after existing controls have been applied and evaluated. Inherent risk is measured before controls, appetite is the risk leadership will tolerate, and transference shifts impact to a third party.

Question 31Essential Security Principles

A company purchases a cyber insurance policy to cover losses from a breach. Which risk treatment strategy is this?

  1. Risk acceptance
  2. Risk avoidance
  3. Risk mitigation
  4. Risk transfer Correct answer.

Explanation

Insurance shifts the financial consequences of a loss to a third party, which is risk transfer. The activity still occurs and controls may still be needed, but the monetary impact is shared with the insurer.

Question 32Essential Security Principles

Which of the following is a detective control?

  1. A badge reader at the data center door
  2. A firewall rule blocking port 23
  3. A SIEM alert on repeated failed logins Correct answer.
  4. Encryption of a database at rest

Explanation

Detective controls identify and record events while or after they occur, so monitoring logs for suspicious patterns fits this category. The other options stop an action from happening and are therefore preventive.

Question 33Essential Security Principles

Internet-facing web servers that must accept connections from untrusted networks should be placed in which network zone?

  1. The internal server VLAN
  2. A screened subnet (DMZ) Correct answer.
  3. A management subnet
  4. A guest wireless network

Explanation

A screened subnet, commonly called a DMZ, isolates public-facing hosts from the internal network so a compromised server has limited reach. Internal server and management networks should not be directly reachable from untrusted networks.

Question 34Essential Security Principles

Which component of a public key infrastructure signs digital certificates that bind a public key to an identity?

  1. The certificate revocation list
  2. The certificate authority Correct answer.
  3. The registration authority
  4. The relying party

Explanation

The certificate authority verifies the subject through its registration process and then signs the certificate with its own private key. Relying parties trust that signature, and revocation lists report certificates that are no longer valid.

Question 35Essential Security Principles

To send a confidential message using asymmetric encryption so that only the recipient can read it, which key should the sender use to encrypt?

  1. The recipient's public key Correct answer.
  2. The sender's private key
  3. A shared secret key exchanged beforehand
  4. The recipient's private key

Explanation

Asymmetric encryption uses the recipient's public key so that only the matching private key, which the recipient alone holds, can decrypt. Keys are used in opposite roles for signing, and pre-shared secrets belong to symmetric cryptography.

Question 36Essential Security Principles

During which incident response phase does the team remove malicious code and close the vulnerability that allowed the intrusion?

  1. Recovery
  2. Post-incident activity
  3. Preparation
  4. Eradication Correct answer.

Explanation

Eradication eliminates the threat itself, including malware, attacker accounts, and the underlying weakness, before systems are restored. Recovery follows eradication, while preparation and post-incident activity sit at the beginning and end of the lifecycle.

Question 37Essential Security Principles

Which practice follows the 3-2-1 backup rule?

  1. Two copies on three disks, one verified daily
  2. Three copies on three media in one data center
  3. Three copies on two media, one stored offsite Correct answer.
  4. Three versions on a single server, two encrypted

Explanation

The 3-2-1 rule calls for three copies of the data, on two different media types, with one copy kept offsite so that a single event cannot destroy every copy. Variants that keep all copies on one server or one site defeat the purpose.

Question 38Essential Security Principles

A business manager decides which employees may view a dataset and how it should be labeled, while an IT administrator operates the storage platform and applies the backups. Which roles do these two people hold?

  1. Data controller and data processor
  2. Data owner and data custodian Correct answer.
  3. Data custodian and data owner
  4. Data steward and data subject

Explanation

The data owner is the business leader accountable for classification and access decisions, while the data custodian performs the technical handling such as storage, backup, and implementation of access rules. Controller and processor are privacy-law roles, and a data subject is the person the data describes.

Question 39Essential Security Principles

An organization stores copies of encryption keys with a trusted third party so that encrypted archives can be recovered if a key holder leaves the company. Which concept does this describe?

  1. Key stretching
  2. Perfect forward secrecy
  3. Key rotation
  4. Key escrow Correct answer.

Explanation

Key escrow keeps a recovery copy of keys with a trusted party so encrypted data remains accessible when the original holder is unavailable. Rotation changes keys on a schedule, forward secrecy protects past sessions, and stretching slows password guessing.

Question 40Essential Security Principles

A downloaded installer matches the hash published on the vendor's website, but the installer turns out to be malicious. Which statement best explains this?

  1. Hashing encrypts the file, so it can be broken
  2. Hashes cannot detect any change to a file
  3. It proves the file matches the vendor's copy, not safety Correct answer.
  4. A matching hash proves the vendor digitally signed the file with its private key

Explanation

A hash shows only that the file is identical to the one whose value was published, so integrity is established relative to that source. If the source or the file it distributes is compromised, the comparison still succeeds while giving no assurance that the content is benign.

Question 41Basic Network Security Concepts

Which OSI layer is responsible for logical addressing and for choosing a path between networks?

  1. Network layer Correct answer.
  2. Transport layer
  3. Data link layer
  4. Physical layer

Explanation

The network layer (layer 3) handles logical addressing such as IP addresses and uses routing to move packets between different networks. Layers below it deal with framing and signaling on a single link, and the transport layer manages end-to-end delivery between processes.

Question 42Basic Network Security Concepts

Which transport-layer protocol is connection-oriented and begins with a three-way handshake?

  1. UDP
  2. ICMP
  3. TCP Correct answer.
  4. ARP

Explanation

TCP establishes a session with a SYN, SYN-ACK, ACK exchange before data is sent, which lets it provide reliable, ordered delivery. The other protocols listed are not connection-oriented transport protocols.

Question 43Basic Network Security Concepts

Which TCP port is used by default for HTTPS?

  1. 80
  2. 443 Correct answer.
  3. 53
  4. 22

Explanation

HTTPS defaults to TCP port 443, carrying HTTP inside a TLS session. The other well-known ports belong to different services and are commonly memorized alongside it.

Question 44Basic Network Security Concepts

What is the purpose of a DMZ in a network architecture?

  1. It stores offline backups of critical servers for disaster recovery.
  2. It encrypts all traffic between remote users and the corporate network.
  3. It isolates internet-facing services from internal hosts. Correct answer.
  4. It hides internal IP addresses from the internet by using NAT.

Explanation

A DMZ is a separate segment that hosts publicly reachable services so that a compromise there does not directly expose the internal network. Traffic between the DMZ and the internal LAN is then tightly controlled by firewall policy.

Question 45Basic Network Security Concepts

Which firewall capability tracks the state of active connections and automatically permits the return traffic?

  1. Network address translation
  2. Stateless packet filtering
  3. Content caching proxy
  4. Stateful inspection Correct answer.

Explanation

A stateful firewall records each connection in a state table and lets replies through without a separate inbound rule. Stateless filters evaluate each packet in isolation and therefore need explicit rules for return traffic.

Question 46Basic Network Security Concepts

What is the primary security benefit of dividing a LAN into VLANs?

  1. It authenticates users before they log on.
  2. It limits broadcast domains and lateral movement. Correct answer.
  3. It assigns public IP addresses to internal hosts.
  4. It encrypts traffic between switches.

Explanation

VLANs create separate layer 2 broadcast domains, so hosts in one VLAN cannot reach another without passing through a router or firewall where policy can be applied. That containment reduces the spread of attacks such as broadcast flooding or worm propagation.

Question 47Basic Network Security Concepts

Which solution inspects network traffic for malicious patterns and can drop the offending packets inline?

  1. A host-based antivirus agent running on servers
  2. An inline IPS Correct answer.
  3. A centralized syslog collector
  4. A passive network TAP

Explanation

An intrusion prevention system sits in the traffic path and can block a session when a signature or anomaly matches. An IDS or a TAP only observes and alerts, leaving enforcement to another device.

Question 48Basic Network Security Concepts

Which technology provides an encrypted tunnel for a remote worker's traffic over the internet?

  1. DHCP
  2. NAT
  3. VPN Correct answer.
  4. DNS

Explanation

A VPN encapsulates and encrypts traffic between the client and a gateway, protecting it as it crosses untrusted networks. The other protocols provide addressing, configuration, or name resolution rather than confidentiality.

Question 49Basic Network Security Concepts

A voice-over-IP application needs low latency and can tolerate occasional lost packets. Which transport protocol is the better fit?

  1. ICMP
  2. TCP
  3. ARP
  4. UDP Correct answer.

Explanation

UDP avoids handshakes and retransmission delays, which suits real-time media that prefers a dropped packet over a late one. TCP's reliability mechanisms can add latency that degrades call quality.

Question 50Basic Network Security Concepts

An attacker on the same subnet sends forged replies claiming that the default gateway's IP address maps to the attacker's own MAC address. Which attack is this?

  1. VLAN hopping
  2. DNS poisoning
  3. DHCP starvation
  4. ARP spoofing Correct answer.

Explanation

ARP has no authentication, so any host can answer for another IP address and redirect local traffic through itself. This is ARP spoofing, which enables on-path interception of the victim's traffic.