thinQmaster — free preview
CCST Cybersecurity (100-160). Set it up and run it.
This is not a sample sheet — it is the application, running. Pick
your mode, your length, your domain, the same way you would inside the full title.
Study mode marks each answer and tells you why the right one is right and why each
wrong one is wrong; Simulation puts a clock on it and chooses each question from
whatever you are weakest in. No account, no e-mail address, no card.
Free · nothing to sign up for
The five questions
1. Refer to the exhibit. An analyst reviews an Nmap scan of a server. Which open port represents a cleartext remote-access service that should be disabled?
- A. 23/tcp telnet
- B. 22/tcp ssh
- C. 80/tcp http
- D. 443/tcp https
Correct answer: A.
Port 23 runs Telnet, a cleartext remote-access protocol that exposes credentials, so it is the service an analyst should disable in favor of encrypted SSH on port 22.
Why the others are wrong. Port 22 SSH is the encrypted remote-access replacement and should be kept. Port 80 HTTP is cleartext but serves web pages, not remote administration. Port 443 HTTPS is encrypted web traffic. Only Telnet on port 23 is a cleartext remote-access service.
2. A team wants to strengthen the confidentiality of stored customer data. Which two measures most directly support confidentiality? (Choose two.)
- A. Encrypting the database at rest
- B. Deploying redundant power supplies
- C. Keeping hourly system backups
- D. Load-balancing across extra servers
- E. Enforcing access controls on the records
Correct answer: A.
Encryption and access controls both restrict who can read data, which is the essence of confidentiality; encryption protects the stored data and access controls limit which accounts can view it.
Why the others are wrong. Redundant power supplies, hourly backups, and load balancing all improve availability by keeping systems running and recoverable, but none of them limit who can read the data, so they do not strengthen confidentiality.
3. A hospital encrypts patient records so that only authorized staff can read them. Which principle of the CIA triad does encrypting these records primarily protect?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Non-repudiation
Correct answer: C.
Encryption keeps information secret so that only authorized people can read it, which is exactly the goal of confidentiality in the CIA triad. Unauthorized readers see only unreadable ciphertext.
Why the others are wrong. Integrity concerns whether data has been altered, not whether it is kept secret. Availability concerns whether authorized users can reach the data when needed. Non-repudiation ensures a sender cannot deny an action and is not the main aim of encrypting stored records.
4. A file transfer must arrive complete and in order, using acknowledgments and retransmission of any lost segments. Which transport protocol provides this reliable, connection-oriented delivery?
- A. ICMP
- B. UDP
- C. ARP
- D. TCP
Correct answer: D.
TCP is connection-oriented and uses sequence numbers, acknowledgments, and retransmission to guarantee that data arrives complete and in order, which is exactly what a reliable file transfer requires.
Why the others are wrong. ICMP carries control and error messages like ping rather than application data. UDP is connectionless and never retransmits lost data, so it cannot guarantee ordered delivery. ARP maps IP addresses to MAC addresses on a LAN and is not a transport protocol at all.
5. A traditional antivirus product compares files on a computer against a database of known malware patterns before allowing them to run. What is this detection method called?
- A. Behavioral analysis
- B. Network sandboxing
- C. Least-privilege enforcement
- D. Signature-based detection
Correct answer: D.
Signature-based detection matches files against a database of known malware patterns, or signatures, which is exactly what the antivirus described is doing before it permits a file to run.
Why the others are wrong. Behavioral analysis watches how a program acts rather than matching known patterns, so it is not the method described. Network sandboxing detonates files in an isolated environment instead of comparing signatures. Least-privilege enforcement limits account permissions and has nothing to do with malware pattern matching.
6. A security team wants an automated tool that checks its servers against a database of known weaknesses and reports which ones are present. What type of tool is this?
- A. A packet sniffer
- B. A vulnerability scanner
- C. A password cracker
- D. A load balancer
Correct answer: B.
A vulnerability scanner automatically compares a system against a database of known weaknesses and reports which ones it finds, which is exactly the described task. It helps teams see their exposure before attackers do.
Why the others are wrong. A packet sniffer captures network traffic for analysis but does not check systems against a weakness database. A password cracker tries to recover or guess credentials rather than identify software flaws. A load balancer distributes traffic across servers and has nothing to do with finding vulnerabilities.
7. A security team is documenting its incident response process. Which phase of the incident response lifecycle comes first, before any incident has occurred?
- A. Preparation
- B. Containment
- C. Recovery
- D. Eradication
Correct answer: A.
Preparation is the first phase and takes place before any incident. It builds the plans, tools, training, and contacts a team needs so it can respond quickly and effectively when something does happen.
Why the others are wrong. Containment happens after an incident is detected, to limit its spread. Eradication removes the threat once the incident is understood, and recovery restores systems afterward. All three occur during or after an incident, so none of them can be the first phase performed beforehand.
8. A software vendor publishes a checksum next to a download so users can confirm the file was not changed in transit. Which CIA principle does this support?
- A. Availability
- B. Integrity
- C. Confidentiality
- D. Authenticity
Correct answer: B.
A checksum lets a user verify that a file's contents have not been altered, which is the definition of integrity in the CIA triad. A mismatch reveals tampering or corruption.
Why the others are wrong. Availability is about the file being reachable when wanted, not about detecting changes. Confidentiality would involve keeping the file secret, which a public download is not. Authenticity concerns proving who created the file, which a plain checksum alone does not establish.
