Cisco 100-160 Exam Dumps

The CCST Cybersecurity Study Guide identifies SYN flood attacks as a type of Denial of Service (DoS) attack that exploits the TCP three-way handshake. Attackers send many SYN requests without completing the handshake, leaving the server with numerous half-open connections and exhausting resources.

'A TCP SYN flood attack overwhelms a target server by initiating a high volume of TCP connections but never completing the handshake, resulting in numerous half-open connections that consume system resources and can render the service unavailable.'

(CCST Cybersecurity, Incident Handling, Denial-of-Service Attacks section, Cisco Networking Academy)

A is correct: The proper action is to stop the SYN flood, often using firewalls, intrusion prevention systems, or SYN cookies.

B (switching to HTTPS) does not address the flooding issue.

C is incorrect because the excessive number of half-open connections indicates an attack, not normal operation.

D (flushing DNS cache) is unrelated to this type of attack.

The CCST Cybersecurity Study Guide emphasizes that backups should be stored off-site or in the cloud to ensure recovery even if the primary location is damaged or compromised.

'A comprehensive disaster recovery plan includes performing regular backups and ensuring copies are stored in locations not subject to the same physical risks as the primary site. Off-site storage and cloud-based backups provide resilience against local disasters.'

(CCST Cybersecurity, Essential Security Principles, Backup and Disaster Recovery section, Cisco Networking Academy)

A is correct: Off-site removable media ensures recovery even if the main site is destroyed.

B is incorrect: Local-only backups are vulnerable to the same risks as production systems.

C is correct: Cloud services provide geographically separate storage with automated redundancy.

D is incorrect: RAID is for hardware fault tolerance, not a complete backup solution.

The CCST Cybersecurity course teaches that vulnerability scan results should be reviewed for misconfigurations and exposures that can be exploited by attackers.

'Disabled firewalls expose systems to direct network attacks and should be treated as critical findings. Open ports can indicate unnecessary or unsecured services running, which may provide entry points for attackers. These findings should be escalated for remediation or further security hardening.'

(CCST Cybersecurity, Vulnerability Assessment and Risk Management, Analyzing and Responding to Scan Results section, Cisco Networking Academy)

Encrypted passwords (A) are good practice, not a vulnerability.

Disabled firewalls (B) leave systems defenseless against incoming attacks.

Open ports (C) can be exploited if the services they expose are vulnerable or misconfigured.

SSH packets (D) are normal in secure remote administration and are not inherently a vulnerability.

The CCST Cybersecurity material states that a Virtual Private Network (VPN) provides secure communication over an untrusted network, typically by ensuring:

Authentication verifying the identity of the user/device

Confidentiality encrypting the data so it cannot be read by unauthorized parties

Integrity ensuring that transmitted data has not been altered in transit

'VPNs secure remote access by authenticating users, encrypting data for confidentiality, and ensuring integrity through cryptographic checks.'

(CCST Cybersecurity, Basic Network Security Concepts, VPNs section, Cisco Networking Academy)

A is incorrect: WAN management is a network administration function, not a VPN feature.

B is incorrect: Authorization is related but not a primary VPN security function.

C is correct: Integrity is preserved through cryptographic hashing.

D is correct: Authentication verifies user identity.

E is correct: Confidentiality is provided via encryption.

F is incorrect: Password management is separate from VPN functions.

In the CCST Cybersecurity course, Windows Event Viewer Error events in the Application log indicate a severe problem that caused an application or component to fail. This usually requires investigation or repair.

'Error events indicate a significant problem such as a loss of functionality in an application or system component. Errors are often critical and need immediate attention.'

(CCST Cybersecurity, Incident Handling, Event Logging and Analysis section, Cisco Networking Academy)

A is incorrect: Performance slowness would usually generate warnings, not errors.

B is correct: An 'Error' level in Event Viewer means the application failed in some way.

C is incorrect: That describes an 'Information' event, not an error.

D is incorrect: That also corresponds to an 'Information' event.