SkillTestPro | CCST Cybersecurity Practice Test 2

CCST Cybersecurity Practice Test 2

CCST Cybersecurity Practice Tests

1 / 25

A company deploys a Security Information and Event Management (SIEM) system to detect anomalies in its network traffic. One alert indicates multiple failed login attempts on a privileged account followed by a successful login from an IP address outside the company's usual geographic locations. What should the security team do first?

Immediately block the IP address and disable the account

Alert the user and ask if they recognize the login attempt

Perform an in-depth forensic analysis before taking any action

Reset the account’s password and require multi-factor authentication (MFA)

Implement a honeypot system to track attacker movements

2 / 25

A penetration tester is attempting to exploit a company's internal network. After gaining low-level access to an employee's machine, they extract cached credentials and attempt to use them to access other network resources with higher privileges. This attack is an example of what technique?

Pass-the-Hash attack

Brute Force attack

Cross-Site Scripting (XSS) attack

Zero-Day exploit

SQL Injection attack

3 / 25

A company's CEO receives an email appearing to be from a trusted business partner, urging immediate transfer of funds due to an "urgent contract issue." The email is well-crafted, does not contain malware, and appears highly convincing. The CEO almost falls for it but consults the cybersecurity team first. What type of attack is this?

Phishing

Whaling

Smishing

Spoofing

Business Email Compromise (BEC)

4 / 25

A financial institution's security team notices a sudden increase in outgoing encrypted traffic from a workstation. The user denies any knowledge of the activity. Upon investigation, analysts discover that the computer is connecting to multiple foreign IP addresses, sending encrypted data. What type of attack is most likely occurring?

Man-in-the-middle attack

Command and Control (C2) communication from malware

SQL injection attack

Privilege escalation attack

Distributed Denial-of-Service (DDoS) attack

5 / 25

A cybersecurity analyst is investigating a suspected Advanced Persistent Threat (APT) on a corporate network. The attacker has been inside the network for several months, stealthily exfiltrating data and avoiding detection by using legitimate administrative tools. What is the most effective method to detect and mitigate this attack?

Perform a simple antivirus scan to remove the threat

Change all user passwords and enable multi-factor authentication

Shut down the affected systems and reinstall the operating system

Conduct threat hunting and implement endpoint detection and response (EDR) solutions

Block all outbound internet traffic to prevent further data exfiltration

6 / 25

An attacker successfully encrypts a company’s files and demands payment for the decryption key. What type of attack is this?

Phishing

Spyware

Ransomware

Keylogger

Trojan

7 / 25

A network administrator wants to monitor and detect suspicious activity on a company's network. What security solution should be used?

Firewall

Antivirus software

Virtual Private Network (VPN)

Proxy server

Intrusion Detection System (IDS)

8 / 25

A cybersecurity team implements role-based access control (RBAC). What is the main purpose of this security measure?

To give all employees full access to the system

To limit user access based on job responsibilities

To require all users to use the same login credentials

To prevent all external network access

To disable all administrator accounts

9 / 25

A user is tricked into installing a fake antivirus program that demands payment to remove nonexistent threats. What type of malware is this?

Spyware

Ransomware

Scareware

Trojan

Worm

10 / 25

A hacker gains administrator privileges on a network by exploiting a software vulnerability. What type of attack is this?

Brute force attack

Phishing attack

Spoofing attack

Rootkit attack

Privilege escalation

11 / 25

A company wants to ensure that only authorized users can access critical systems. What security measure should be implemented?

Data encryption

Multi-factor authentication

Network segmentation

Antivirus software

Strong password policies

12 / 25

A security analyst is investigating an attack where an attacker intercepts communication between two parties without their knowledge. What type of attack is this?

Phishing

Man-in-the-middle attack

SQL injection

Denial-of-service attack

Ransomware attack

13 / 25

A company wants to prevent unauthorized access to their Wi-Fi network. What is the most secure method?

Using WEP encryption

Hiding the SSID

Reducing the Wi-Fi signal range

Changing the router’s default password

Enabling WPA3 encryption

14 / 25

A company's security team notices a large volume of traffic overwhelming their web server, making it inaccessible to users. What attack is this?

Brute force attack

SQL injection

Man-in-the-middle attack

Denial-of-service (DoS) attack

Privilege escalation

15 / 25

A security team uses penetration testing to evaluate their network defenses. What is the main goal of this test?

To permanently block all cyber threats

To identify and fix security vulnerabilities

To replace the need for antivirus software

To track employee internet usage

To eliminate the need for firewalls

16 / 25

An attacker sends a fake email appearing to be from a trusted source to trick an employee into clicking a malicious link. What is this technique called?

Phishing

Spoofing

Smishing

Social engineering

Man-in-the-middle attack

17 / 25

A security team is implementing a zero-trust model. What does this approach emphasize?

Trusting all internal network traffic

Granting users full access to all systems

Verifying every request, regardless of network location

Reducing security measures for internal users

Allowing anonymous access to internal resources

18 / 25

A user reports their computer is running slow, and a security scan detects a program capturing their keystrokes. What type of malware has infected their system?

Trojan

Worm

Ransomware

Keylogger

Rootkit

19 / 25

A company implements biometric authentication for access to sensitive data. What is the main advantage of this method?

It eliminates the need for passwords

It ensures 100% security

It provides a unique, difficult-to-replicate authentication factor

It allows anonymous access to the system

It increases network speed

20 / 25

A hacker disguises malicious software as a legitimate application to trick users into installing it. What type of attack is this?

Ransomware

Trojan

Rootkit

Spyware

Worm

21 / 25

A cybersecurity analyst notices a user's account has accessed sensitive files at unusual hours from an unfamiliar location. What is the best course of action?

Immediately disable the account

Reset the user’s password

Investigate further for possible account compromise

Notify the user and ask them to confirm activity

Ignore the activity if no data was changed

22 / 25

A company wants to ensure that data sent over the internet is not intercepted or modified. What security principle should be applied?

Availability

Confidentiality

Authentication

Non-repudiation

Integrity

23 / 25

A cybersecurity analyst is investigating a malware infection that spreads without user interaction and exploits system vulnerabilities. What type of malware is this?

Trojan

Spyware

Worm

Ransomware

Rootkit

24 / 25

A company's security logs show multiple failed login attempts from different locations worldwide in a short period. What does this indicate?

A brute force attack

A distributed denial-of-service (DDoS) attack

A ransomware attack

A phishing attack

A SQL injection attack

25 / 25

An employee receives a phone call from someone claiming to be from the IT department, requesting their login credentials to fix an urgent issue. What type of attack is this?

Phishing

Smishing

Social engineering

Pretexting

Vishing

Your score is

The average score is 0%