Cisco Certified Support Technician (CCST) Cybersecurity Exam Guide

The successful candidate will possess essential knowledge and skills required to showcase proficiency in cybersecurity. This exam serves as an introductory gateway into the Cisco Certified program, with Cisco’s CyberOps as the subsequent certification level.

This certification is tailored for entry-level cybersecurity technicians, students, interns, and others beginning their career in this field. The exam is aimed at secondary and immediate post-secondary level students, as well as entry-level IT and cybersecurity professionals. Candidates who pass this exam will be recognized as ready-to-work cybersecurity technicians, having completed a minimum of 150 hours of instructional learning and practical, hands-on experience.

1. Essential Security Principles

The domain of Essential Security Principles provides the foundation for understanding the key elements that underpin secure network environments. It encompasses the study of vulnerabilities, threats, exploits, and risks that networks face regularly. Core concepts such as attack vectors and system hardening are covered to equip professionals with the ability to fortify networks against unauthorized access and breaches. The principle of defense-in-depth encourages the implementation of multiple layers of security to provide redundancy and mitigate potential breaches more effectively.

The confidentiality, integrity, and availability (CIA) triad is a staple of security policy that guides the protection of data across all types of IT systems. Understanding different types of attackers and their motivations helps in anticipating and defending against attacks more effectively. Furthermore, the ethical considerations, encapsulated in a professional code of ethics, ensure that cybersecurity practices are aligned with legal and moral standards.

1.1 Define essential security principles:

• Vulnerabilities, threats, exploits, and risks; attack vectors; hardening; defense-in-depth; confidentiality, integrity, and availability (CIA); types of attackers; reasons for attacks; code of ethics: This encompasses the core concepts of cybersecurity, including understanding potential weaknesses (vulnerabilities), anticipated malicious actions (threats and exploits), and the importance of a multilayered security approach (defense-in-depth). The CIA triad is fundamental to security, prioritizing the confidentiality, integrity, and availability of information.

1.2 Explain common threats and vulnerabilities:

• Malware, ransomware, denial of service, botnets, social engineering attacks (tailgating, spear phishing, phishing, vishing, smishing, etc.), physical attacks, man in the middle, IoT vulnerabilities, insider threats, Advanced Persistent Threat (APT): This outlines various forms of cyber threats that an organization may face, ranging from software-based threats like malware and ransomware to human-centric attacks like phishing and social engineering, each requiring specific awareness and countermeasures.

1.3 Explain access management principles:

• Authentication, authorization, and accounting (AAA); RADIUS; multifactor authentication (MFA); password policies: These principles are critical for controlling user access within a network, ensuring that only authorized users can access certain data or systems, and tracking their activities for security and compliance purposes.

1.4 Explain encryption methods and applications:

• Types of encryption, hashing, certificates, public key infrastructure (PKI); strong vs. weak encryption algorithms; states of data and appropriate encryption (data in transit, data at rest, data in use); protocols that use encryption: Discusses the various ways data can be protected through cryptographic methods, ensuring data confidentiality and integrity across different states and transmissions.

2. Basic Network Security Concepts

In the Basic Network Security Concepts domain, professionals learn about the intricacies of the TCP/IP protocols, which, while forming the backbone of the internet, contain inherent vulnerabilities that must be managed. Topics such as the impact of different network addresses (IPv4 and IPv6) on security, and how proper segmentation and network address translation (NAT) can enhance security, are explored in detail.

This domain also dives into the architectural components of network security, including the use of demilitarized zones (DMZs), virtualization, and the deployment of intrusion detection systems (IDS) and intrusion prevention systems (IPS). Setting up secure wireless networks, especially in smaller, office-home office (SoHo) environments, also forms a critical part of learning, encompassing everything from MAC address filtering to implementing robust encryption protocols.

2.1 Describe TCP/IP protocol vulnerabilities:

• TCP, UDP, HTTP, ARP, ICMP, DHCP, DNS: Highlights the inherent security weaknesses in some of the fundamental protocols used in networking, which can be exploited by attackers and need to be mitigated through proper network security measures.

2.2 Explain how network addresses impact network security:

• IPv4 and IPv6 addresses, MAC addresses, network segmentation, CIDR notation, NAT, public vs. private networks: Understanding the role of different addressing schemes and techniques in network security helps in designing secure networks that can shield sensitive data and systems from unauthorized access.

2.3 Describe network infrastructure and technologies:

• Network security architecture, DMZ, virtualization, cloud, honeypot, proxy server, IDS, IPS: Covers the components and technologies that constitute a secure network architecture, including devices and strategies to monitor, detect, and prevent security breaches.

2.4 Set up a secure wireless SoHo network:

• MAC address filtering, encryption standards and protocols, SSID: Involves configuring small office/home office networks with robust security measures to protect against unauthorized access and eavesdropping.

2.5 Implement secure access technologies:

• ACL, firewall, VPN, NAC: Focuses on the technologies that manage and control access to network resources, crucial for maintaining the security perimeter of an organization.

3. Endpoint Security Concepts

Endpoint Security Concepts focus on securing the various devices that connect to a network, ranging from traditional workstations to modern IoT devices. This domain covers the security features available in different operating systems such as Windows, macOS, and Linux, including built-in protections like Windows Defender and various host-based firewalls.

Professionals learn to use and interpret the output of network tools like netstat and nslookup that help in security assessments. Ensuring that endpoints comply with security policies and standards involves regular checks of system configurations, software installations, and ensuring all devices are covered by up-to-date antivirus solutions and have the necessary patches applied.

3.1 Describe operating system security concepts:

• Windows, macOS, and Linux; security features, including Windows Defender and host-based firewalls; CLI and PowerShell; file and directory permissions; privilege escalation: This involves understanding the security capabilities and configurations specific to different operating systems which are essential for protecting endpoint devices.

3.2 Demonstrate familiarity with appropriate endpoint tools that gather security assessment information:

• Netstat, nslookup, tcpdump: Utilizing these tools helps in assessing and monitoring the security posture of endpoint devices, crucial for detecting anomalies and potential threats.

3.3 Verify that endpoint systems meet security policies and standards:

• Hardware inventory, software inventory, program deployment, data backups, regulatory compliance (PCI DSS, HIPAA, GDPR), BYOD (device management, data encryption, app distribution, configuration management): Ensures that all endpoint devices comply with organizational security policies and regulatory requirements, critical for maintaining overall network security.

3.4 Implement software and hardware updates:

• Windows Update, application updates, device drivers, firmware, patching: Regular updates and patch management are vital for protecting devices against known vulnerabilities and exploits.

3.5 Interpret system logs:

• Event Viewer, audit logs, system and application logs, syslog, identification of anomalies: Effective log management and analysis are key to identifying, investigating, and responding to security incidents or irregularities in system operations.

4. Vulnerability Assessment and Risk Management

Vulnerability Assessment and Risk Management are critical in identifying, assessing, and mitigating vulnerabilities within an organization’s network. This domain teaches how to conduct both active and passive reconnaissance to gather necessary intelligence about potential vulnerabilities. The use of standardized tools and techniques for vulnerability scanning and the importance of continuous monitoring and updating of the vulnerability management process are emphasized.

Professionals are also trained in risk management techniques, learning how to differentiate between vulnerabilities and risks, rank the risks, and apply suitable mitigation strategies. The discussion extends to understanding the nuances of disaster recovery and business continuity planning, which ensures that the organization can continue operations even in the event of significant disruptions.

4.1 Explain vulnerability management:

• Vulnerability identification, management, and mitigation; active and passive reconnaissance; testing (port scanning, automation): Discusses the processes involved in identifying, assessing, and mitigating vulnerabilities within an organization’s network to prevent potential exploits.

4.2 Use threat intelligence techniques to identify potential network vulnerabilities:

• Uses and limitations of vulnerability databases; industry-standard tools used to assess vulnerabilities and make recommendations, policies, and reports; Common Vulnerabilities and Exposures (CVEs), cybersecurity reports, cybersecurity news, subscription services, and collective intelligence; ad hoc and automated threat intelligence; the importance of updating documentation and other forms of communication proactively before, during, and after cybersecurity incidents; how to secure, share and update documentation: Involves the application of threat intelligence to enhance the organization’s understanding of potential security threats and to better prepare for, respond to, and recover from cyber attacks.

4.3 Explain risk management:

• Vulnerability vs. risk, ranking risks, approaches to risk management, risk mitigation strategies, levels of risk (low, medium, high, extremely high), risks associated with specific types of data and data classifications, security assessments of IT systems (information security, change management, computer operations, information assurance): This includes the processes involved in identifying, analyzing, and responding to risk factors that could potentially impact an organization’s information security.

4.4 Explain the importance of disaster recovery and business continuity planning:

• Natural and human-caused disasters, features of disaster recovery plans (DRP) and business continuity plans (BCP), backup, disaster recovery controls (detective, preventive, and corrective): Stresses the critical role of planning and preparing for potential disruptions to business operations, ensuring the organization can continue to function and recover from disruptions effectively.

5. Incident Handling

The Incident Handling domain focuses on the strategies and skills required to manage and respond to security incidents. This includes monitoring security events, understanding when and how to escalate, and utilizing Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) tools effectively.

Digital forensics plays a significant role in this domain, as professionals learn about the processes involved in collecting, preserving, and analyzing evidence following a cybersecurity incident. The domain covers the Cyber Kill Chain, MITRE ATT&CK Matrix, and Diamond Model to conceptualize the attack strategies that adversaries might use.

Furthermore, understanding the impact of various compliance frameworks on incident handling ensures that responses not only mitigate the damage but also comply with legal requirements, safeguarding the organization from further legal implications.

These domains collectively provide a comprehensive framework for understanding and implementing effective cybersecurity measures, equipping professionals with the knowledge and skills necessary to protect network environments and manage security risks efficiently.

5.1 Monitor security events and know when escalation is required:

• Role of SIEM and SOAR, monitoring network data to identify security incidents (packet captures, various log file entries, etc.), identifying suspicious events as they occur: Involves the continuous monitoring of security events and the ability to discern when these events signify a security incident that requires escalation to higher-level security personnel or response teams.

5.2 Explain digital forensics and attack attribution processes:

• Cyber Kill Chain, MITRE ATT&CK Matrix, and Diamond Model; Tactics, Techniques, and Procedures (TTP); sources of evidence (artifacts); evidence handling (preserving digital evidence, chain of custody): Focuses on the methodologies and practices in digital forensics used to investigate and determine the sources of cyber attacks, crucial for effective incident response and legal proceedings.

5.3 Explain the impact of compliance frameworks on incident handling:

• Compliance frameworks (GDPR, HIPAA, PCI-DSS, FERPA, FISMA), reporting and notification requirements: Understanding the requirements of various regulatory frameworks ensures that incident handling procedures comply with legal and regulatory standards, protecting the organization from legal repercussions.

5.4 Describe the elements of cybersecurity incident response:

• Policy, plan, and procedure elements; incident response lifecycle stages (NIST Special Publication 800-61 sections 2.3, 3.1-3.4): Outlines the structured approach to responding to cybersecurity incidents, including preparation, detection, containment, eradication, and recovery, to minimize damage and restore operations quickly.