CISCO CERTIFIED SUPPORT TECHNICIAN
CYBERSECURITY EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. An organization discovers that an attacker modified several
records in its customer database. Users can still access the database,
and the database remains available, but some information is no
longer trustworthy. Which element of the CIA triad has been
primarily violated?
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: B. Integrity
Rationale: Integrity ensures that information remains accurate,
complete, and protected from unauthorized modification. Because the
attacker changed database records, the primary security failure is
integrity. Confidentiality would concern unauthorized disclosure,
while availability concerns access to systems or information.
2. A cybersecurity technician is reviewing a security architecture
that uses firewalls, endpoint protection, network segmentation,
strong authentication, encryption, logging, and user security
awareness training. Which security principle is best represented by
this architecture?
1
,A. Single sign-on
B. Defense in depth
C. Least privilege
D. Data minimization
Answer: B. Defense in depth
Rationale: Defense in depth uses multiple independent or
complementary security controls so that failure of one control does not
automatically compromise the organization. For example, if a
phishing attack bypasses email filtering, MFA, endpoint protection,
segmentation, and monitoring can still reduce the impact.
3. A company requires every employee to use a unique username
and password. After entering the credentials, employees must
provide a code generated by a mobile authenticator application.
What security concept is being implemented?
A. Multifactor authentication
B. Network segmentation
C. Data masking
D. Single-factor authentication
Answer: A. Multifactor authentication
Rationale: Multifactor authentication requires authentication factors
from different categories, such as something you know, something you
have, or something you are. A password is something the user knows,
while an authenticator application or hardware token represents
something the user has.
4. An employee receives an email appearing to come from the
organization's finance department. The email urgently requests the
2
,employee to click a link and enter corporate credentials. The link
leads to a fraudulent login page. What type of attack is this?
A. Phishing
B. DDoS
C. SQL injection
D. ARP poisoning
Answer: A. Phishing
Rationale: Phishing uses deceptive communications to trick victims
into revealing information, executing malicious actions, or visiting
malicious websites. Credential-harvesting login pages are a common
phishing technique.
5. A security analyst discovers that an application contains a
programming flaw that could allow an attacker to execute
unauthorized commands. No attack has occurred yet. What does the
programming flaw represent?
A. Threat
B. Vulnerability
C. Exploit
D. Incident
Answer: B. Vulnerability
Rationale: A vulnerability is a weakness that could be exploited. A
threat is a potential source of harm, while an exploit is a technique or
code used to take advantage of a vulnerability. An incident occurs
when a security event actually results in or threatens a security
violation.
3
, 6. A malicious actor uses specially crafted input to exploit a
weakness in a web application's database query. Which term best
describes the mechanism used to take advantage of the weakness?
A. Asset
B. Exploit
C. Control
D. Baseline
Answer: B. Exploit
Rationale: An exploit is a method, technique, or piece of code used to
take advantage of a vulnerability. In this scenario, the attacker is
deliberately crafting input to trigger vulnerable database behavior.
7. A security technician is determining which systems should receive
security patches first. One internet-facing server contains a critical
vulnerability that is actively being exploited, while an isolated
workstation contains a low-severity vulnerability. Which system
should receive priority?
A. The isolated workstation
B. The internet-facing server
C. Both systems must have identical priority
D. Neither system until an incident occurs
Answer: B. The internet-facing server
Rationale: Risk-based vulnerability management considers factors
such as vulnerability severity, exposure, asset importance, exploit
availability, and business impact. An internet-facing system with an
actively exploited critical vulnerability presents substantially greater
risk.
4
CYBERSECURITY EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. An organization discovers that an attacker modified several
records in its customer database. Users can still access the database,
and the database remains available, but some information is no
longer trustworthy. Which element of the CIA triad has been
primarily violated?
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: B. Integrity
Rationale: Integrity ensures that information remains accurate,
complete, and protected from unauthorized modification. Because the
attacker changed database records, the primary security failure is
integrity. Confidentiality would concern unauthorized disclosure,
while availability concerns access to systems or information.
2. A cybersecurity technician is reviewing a security architecture
that uses firewalls, endpoint protection, network segmentation,
strong authentication, encryption, logging, and user security
awareness training. Which security principle is best represented by
this architecture?
1
,A. Single sign-on
B. Defense in depth
C. Least privilege
D. Data minimization
Answer: B. Defense in depth
Rationale: Defense in depth uses multiple independent or
complementary security controls so that failure of one control does not
automatically compromise the organization. For example, if a
phishing attack bypasses email filtering, MFA, endpoint protection,
segmentation, and monitoring can still reduce the impact.
3. A company requires every employee to use a unique username
and password. After entering the credentials, employees must
provide a code generated by a mobile authenticator application.
What security concept is being implemented?
A. Multifactor authentication
B. Network segmentation
C. Data masking
D. Single-factor authentication
Answer: A. Multifactor authentication
Rationale: Multifactor authentication requires authentication factors
from different categories, such as something you know, something you
have, or something you are. A password is something the user knows,
while an authenticator application or hardware token represents
something the user has.
4. An employee receives an email appearing to come from the
organization's finance department. The email urgently requests the
2
,employee to click a link and enter corporate credentials. The link
leads to a fraudulent login page. What type of attack is this?
A. Phishing
B. DDoS
C. SQL injection
D. ARP poisoning
Answer: A. Phishing
Rationale: Phishing uses deceptive communications to trick victims
into revealing information, executing malicious actions, or visiting
malicious websites. Credential-harvesting login pages are a common
phishing technique.
5. A security analyst discovers that an application contains a
programming flaw that could allow an attacker to execute
unauthorized commands. No attack has occurred yet. What does the
programming flaw represent?
A. Threat
B. Vulnerability
C. Exploit
D. Incident
Answer: B. Vulnerability
Rationale: A vulnerability is a weakness that could be exploited. A
threat is a potential source of harm, while an exploit is a technique or
code used to take advantage of a vulnerability. An incident occurs
when a security event actually results in or threatens a security
violation.
3
, 6. A malicious actor uses specially crafted input to exploit a
weakness in a web application's database query. Which term best
describes the mechanism used to take advantage of the weakness?
A. Asset
B. Exploit
C. Control
D. Baseline
Answer: B. Exploit
Rationale: An exploit is a method, technique, or piece of code used to
take advantage of a vulnerability. In this scenario, the attacker is
deliberately crafting input to trigger vulnerable database behavior.
7. A security technician is determining which systems should receive
security patches first. One internet-facing server contains a critical
vulnerability that is actively being exploited, while an isolated
workstation contains a low-severity vulnerability. Which system
should receive priority?
A. The isolated workstation
B. The internet-facing server
C. Both systems must have identical priority
D. Neither system until an incident occurs
Answer: B. The internet-facing server
Rationale: Risk-based vulnerability management considers factors
such as vulnerability severity, exposure, asset importance, exploit
availability, and business impact. An internet-facing system with an
actively exploited critical vulnerability presents substantially greater
risk.
4
