Certified Cybersecurity Technician (CCT) Exam — Questions and Answers

Question 1: During a forensic investigation, an examiner finds a file with a .jpg extension but the magic bytes read '50 4B 03 04'. What does this indicate?

The file is encrypted AES-256
The file is a Windows PE executable
The file is a valid JPEG image
The file is actually a ZIP archive with a renamed extension (Correct answer)

Correct answer: The file is actually a ZIP archive with a renamed extension

Magic bytes 50 4B 03 04 are the signature for ZIP archives (PK header); the .jpg extension is a disguise used to evade file-type filters.

Question 2: What is the first step in an incident response plan?

Shutting down all systems
Contacting the affected users
Identifying and classifying the incident (Correct answer)
Performing a system reboot

Correct answer: Identifying and classifying the incident

The first step in an incident response plan is crucial for effective management. It involves accurately identifying that an incident has occurred and classifying its type and severity, which guides subsequent actions and resource allocation to address the specific threat.

Question 3: What is the recommended approach to staying current in Access Control & Identity Management?

Reviewing initial training materials once per year
Relying solely on past experience
Regular professional development, industry publications, and peer collaboration (Correct answer)
Waiting for regulatory changes to force updates

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Access Control & Identity Management requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 4: Which type of social engineering attack involves creating a fabricated scenario to manipulate a target into divulging information?

Pretexting (Correct answer)
Baiting
Phishing
Tailgating

Correct answer: Pretexting

Pretexting involves constructing a fabricated scenario (a pretext) to extract information or gain trust from a target, such as impersonating IT support to get a user's password.

Question 5: What is privilege escalation in the context of a penetration test?

Gaining initial access to a target system
Covering tracks after completing a test
Exfiltrating data from a compromised host
Increasing access rights from a lower-privileged account to a higher-privileged one (Correct answer)

Correct answer: Increasing access rights from a lower-privileged account to a higher-privileged one

Privilege escalation involves exploiting vulnerabilities or misconfigurations to gain higher-level permissions (e.g., moving from a standard user account to administrator or root).

Question 6: Which memory forensics framework is most commonly used to analyze RAM dumps and detect injected processes, hidden drivers, and network connections?

FTK Imager
Volatility (Correct answer)
YARA
Autopsy

Correct answer: Volatility

Volatility is the industry-standard open-source memory forensics framework that can extract processes, network artifacts, and detect common evasion techniques from RAM images.

Question 7: A forensic examiner recovers a deleted file from an NTFS partition. Which condition must be true for full recovery to be possible?

The file was encrypted before deletion
The file was smaller than 4 KB
The recycle bin has not been emptied
The file's data clusters have not been overwritten by new data (Correct answer)

Correct answer: The file's data clusters have not been overwritten by new data

When a file is deleted, NTFS marks its clusters as available but does not erase them; if those clusters haven't been reallocated, the file content remains recoverable.

Question 8: What is Dynamic Application Security Testing (DAST)?

Analyzing binary code without source access
Testing a running application from the outside to find vulnerabilities (Correct answer)
Scanning network infrastructure for open ports
Reviewing source code for security issues

Correct answer: Testing a running application from the outside to find vulnerabilities

DAST tools test a running application by simulating external attacks, finding vulnerabilities that only manifest during execution, such as authentication issues and runtime errors.

Question 9: Which anti-forensics technique involves an attacker deliberately changing MAC timestamps on files to mislead investigators?

Steganography
Slack space hiding
Log wiping
Timestomping (Correct answer)

Correct answer: Timestomping

Timestomping modifies a file's Modified, Accessed, and Created timestamps to obscure the true timeline of attacker activity.

Question 10: What distinguishes dynamic malware analysis from static analysis?

Dynamic analysis executes the sample in a controlled environment to observe behavior (Correct answer)
Dynamic analysis examines code without execution; static runs the sample
Dynamic analysis requires source code access
Dynamic analysis only works on scripts, not binaries

Correct answer: Dynamic analysis executes the sample in a controlled environment to observe behavior

Dynamic analysis detonates the malware in an isolated sandbox or VM to observe real-time behaviors such as file creation, registry changes, and network calls.

Question 11: What is the recommended way to store user passwords in an application database?

Hashed using a strong adaptive algorithm like bcrypt or Argon2 (Correct answer)
Stored in plaintext with access controls
Encoded in Base64
Encrypted with AES-256

Correct answer: Hashed using a strong adaptive algorithm like bcrypt or Argon2

Adaptive hashing algorithms like bcrypt or Argon2 incorporate salting and are computationally expensive, making brute-force and rainbow table attacks impractical.

Question 12: Why is post-incident analysis important?

To hide weaknesses in response strategies
To identify areas for improvement and prevent future incidents (Correct answer)
To blame employees for the incident
To avoid regulatory reporting

Correct answer: To identify areas for improvement and prevent future incidents

Post-incident analysis, often called a 'lessons learned' review, is vital for continuous improvement in cybersecurity. It involves thoroughly examining the incident, the response actions taken, and the root cause of the breach. This analysis helps identify weaknesses in security controls, policies, or procedures, enabling the organization to implement corrective measures and prevent similar incidents from occurring in the future.

Question 13: What is the recommended approach to staying current in System Administration & Configuration?

Regular professional development, industry publications, and peer collaboration (Correct answer)
Waiting for regulatory changes to force updates
Reviewing initial training materials once per year
Relying solely on past experience

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in System Administration & Configuration requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 14: Which file system artifact is most useful for determining when files were created, modified, or accessed on an NTFS volume?

Master Boot Record (MBR)
File Allocation Table (FAT)
Volume Boot Record (VBR)
$MFT (Master File Table) (Correct answer)

Correct answer: $MFT (Master File Table)

The NTFS $MFT stores metadata for every file including MAC (Modified, Accessed, Created) timestamps, which are critical forensic artifacts.

Question 15: What is the purpose of security policies in an organization?

To limit security awareness training
To outline guidelines for securing systems and networks (Correct answer)
To increase user permissions
To reduce network speed

Correct answer: To outline guidelines for securing systems and networks

Security policies are foundational documents that establish the rules and guidelines for protecting an organization's information assets. They define acceptable use, access controls, data handling procedures, and incident response protocols for all employees and systems. These policies create a framework for a secure environment, ensuring consistent security practices across the organization.

Question 16: Which Nmap scan type is considered a 'stealth scan' because it does not complete the TCP three-way handshake?

FIN scan (-sF)
UDP scan (-sU)
TCP Connect scan (-sT)
SYN scan (-sS) (Correct answer)

Correct answer: SYN scan (-sS)

The SYN scan (half-open scan) sends a SYN packet and analyzes the response without completing the handshake, making it less likely to be logged by many older systems.

Question 17: What is the primary purpose of input validation in secure application development?

Improve application performance
Encrypt user data at rest
Log all user activities
Prevent malicious data from being processed (Correct answer)

Correct answer: Prevent malicious data from being processed

Input validation ensures that only properly formed data enters a system, preventing malicious input from causing vulnerabilities like injection attacks or buffer overflows.

Question 18: Which of the following is a key regulatory framework for cybersecurity compliance?

ISO 9001
CAPEX guidelines
PCI-DSS
HIPAA (Correct answer)

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is a key regulatory framework specifically designed to protect sensitive patient health information. It sets standards for the security, privacy, and integrity of medical data, making it crucial for healthcare organizations and their business associates. Compliance with HIPAA is mandatory to avoid significant penalties and maintain patient trust.

Question 19: What is the primary objective of network security?

To protect the network from unauthorized access (Correct answer)
To monitor employee activity only
To reduce network speed
To increase network traffic

Correct answer: To protect the network from unauthorized access

Network security's primary objective is to safeguard the integrity, confidentiality, and availability of network resources and data. This involves implementing measures like firewalls, encryption, and access controls to prevent unauthorized users from gaining entry or tampering with the network.

Question 20: What is the primary use of steganography in a cybersecurity attack?

Encrypting malware payload to defeat antivirus scans
Obfuscating network traffic using tunneling protocols
Overwriting log files to remove evidence
Hiding data or commands inside innocent-looking carrier files like images (Correct answer)

Correct answer: Hiding data or commands inside innocent-looking carrier files like images

Steganography conceals data within ordinary files (images, audio, video) so that exfiltrated data or C2 commands appear as legitimate media traffic.

Question 21: How does Access Control & Identity Management contribute to overall professional effectiveness?

It serves only as a credential requirement with no practical impact
It is relevant only during the certification examination
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It applies only to supervisory-level professionals

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Access Control & Identity Management directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 22: A malware sample modifies the Windows registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. What is the likely purpose?

Establishing persistence so the malware survives reboots (Correct answer)
Disabling Windows Defender
Exfiltrating data to a C2 server
Escalating privileges to SYSTEM

Correct answer: Establishing persistence so the malware survives reboots

The Run registry key causes listed programs to execute automatically at user logon, making it a common persistence mechanism for malware.

Question 23: How does Cloud Computing & Virtualization contribute to overall professional effectiveness?

It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It is relevant only during the certification examination

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Cloud Computing & Virtualization directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 24: Which penetration testing methodology phase involves gathering information about the target without directly interacting with its systems?

Active reconnaissance
Post-exploitation
Exploitation
Passive reconnaissance (Correct answer)

Correct answer: Passive reconnaissance

Passive reconnaissance collects information about a target using publicly available sources (OSINT) such as WHOIS, DNS records, and social media without sending any packets to the target.

Question 25: What is a common consequence of non-compliance with security policies?

Higher security posture
Data breaches and penalties (Correct answer)
Reduced organizational efficiency
Better protection of assets

Correct answer: Data breaches and penalties

Non-compliance with security policies can lead to severe consequences, including significant data breaches where sensitive information is exposed or stolen. Such breaches often result in substantial financial penalties imposed by regulatory bodies, legal liabilities, and severe damage to an organization's reputation. Adhering to policies is crucial for protecting assets and avoiding these detrimental outcomes.

Question 26: What is the role of data encryption in compliance?

It increases system performance
It ensures data security and compliance with regulations (Correct answer)
It reduces encryption strength
It allows open access to data

Correct answer: It ensures data security and compliance with regulations

Data encryption plays a crucial role in compliance by protecting sensitive information from unauthorized access, both in transit and at rest. Many regulatory frameworks, such as HIPAA and GDPR, mandate the protection of personal and sensitive data, often recommending or requiring encryption. By rendering data unreadable without the correct key, encryption helps organizations meet these security and privacy compliance requirements.

Question 27: What common challenge do professionals face when applying Access Control & Identity Management principles?

Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)
Finding the relevant textbook chapter
Obtaining permission to use the principles
The principles are too simple to present any challenge

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Access Control & Identity Management to the practical constraints and varying conditions encountered in real-world settings.

Question 28: What is the importance of continuous monitoring during an incident?

To detect ongoing attacks and threats (Correct answer)
To ensure that incidents are resolved immediately
To increase downtime for investigation
To avoid creating incident reports

Correct answer: To detect ongoing attacks and threats

Continuous monitoring during an incident is essential for maintaining situational awareness and effectively managing the evolving threat. It allows security teams to detect any ongoing malicious activity, identify new attack vectors, or observe the spread of an attack. This real-time visibility helps in containing the incident, preventing further damage, and ensuring the effectiveness of response actions.

Question 29: How does Emerging Technologies & Trends contribute to overall professional effectiveness?

It is relevant only during the certification examination
It applies only to supervisory-level professionals
It serves only as a credential requirement with no practical impact
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Emerging Technologies & Trends directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 30: What is a 'zero-day' vulnerability?

A vulnerability with a CVSS score of 0.0
A vulnerability first reported on January 1st of any year
A vulnerability that takes zero days to exploit after discovery
A vulnerability that is unknown to the vendor and has no official patch available (Correct answer)

Correct answer: A vulnerability that is unknown to the vendor and has no official patch available

A zero-day vulnerability is a security flaw unknown to the software vendor, meaning zero days have passed since the vendor became aware, so no patch or official mitigation exists.

Question 31: What is the most important competency assessed in Access Control & Identity Management for professionals in this field?

Years of experience without demonstrated skill
Academic credentials without practical application
Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)

Correct answer: Applied knowledge and practical problem-solving ability

Access Control & Identity Management assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 32: What does a Cross-Site Request Forgery (CSRF) attack exploit?

The trust a website has in a user's browser session (Correct answer)
Unsanitized output rendered in the browser
Misconfigured server-side access controls
Weak encryption algorithms in the application

Correct answer: The trust a website has in a user's browser session

CSRF tricks authenticated users into unknowingly submitting malicious requests by exploiting the trust a web application places in the user's authenticated browser session.

Question 33: What is a 'pivot' in penetration testing?

Using a compromised system as a relay to attack other internal systems not directly accessible (Correct answer)
Escalating privileges on a single compromised host
Changing the scope of the engagement mid-test
Switching from active to passive reconnaissance

Correct answer: Using a compromised system as a relay to attack other internal systems not directly accessible

Pivoting uses a compromised host as a jump point to reach and attack other network segments or systems that are not directly reachable from the attacker's machine.

Question 34: What is the relationship between Access Control & Identity Management and ethical professional conduct?

Ethics applies only to separate, unrelated decisions
Ethics is relevant only when legal issues arise
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
There is no connection between technical knowledge and ethics

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Access Control & Identity Management, as professional conduct and integrity underpin all aspects of practice in this field.

Question 35: Why is threat detection important in a cybersecurity strategy?

To identify and mitigate threats before escalation (Correct answer)
To limit system access
To ignore unknown threats
To increase response times

Correct answer: To identify and mitigate threats before escalation

Threat detection is crucial for a robust cybersecurity strategy because it enables organizations to proactively identify malicious activities and potential attacks as they occur. Early detection allows for timely intervention and mitigation, preventing incidents from escalating into major breaches and minimizing damage.

Question 36: Which of the following is a key component of vulnerability management?

Identifying, assessing, and prioritizing vulnerabilities (Correct answer)
Constantly introducing new network devices
Focusing solely on external threats
Ignoring low-level vulnerabilities

Correct answer: Identifying, assessing, and prioritizing vulnerabilities

Vulnerability management is a continuous process designed to reduce an organization's exposure to security risks. It involves systematically discovering security weaknesses, evaluating their potential impact, and ranking them to determine which ones need immediate attention and remediation.

Question 37: What is the relationship between System Administration & Configuration and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics is relevant only when legal issues arise
Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into System Administration & Configuration, as professional conduct and integrity underpin all aspects of practice in this field.

Question 38: How does Monitoring & Performance Optimization contribute to overall professional effectiveness?

It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It applies only to supervisory-level professionals
It serves only as a credential requirement with no practical impact
It is relevant only during the certification examination

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Monitoring & Performance Optimization directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 39: Which principle ensures that digital evidence is not altered during a forensic investigation?

Non-repudiation
Write blocking (Correct answer)
Chain of custody
Order of volatility

Correct answer: Write blocking

Write blockers are hardware or software tools that prevent any write operations to storage media, ensuring evidence integrity during acquisition.

Question 40: What is the primary purpose of the Metasploit Framework in penetration testing?

Capture and analyze network packets
Perform passive DNS reconnaissance
Develop, test, and execute exploit code against target systems (Correct answer)
Scan for open wireless access points

Correct answer: Develop, test, and execute exploit code against target systems

Metasploit is an open-source penetration testing framework that provides a library of exploits, payloads, and auxiliary modules to test vulnerabilities in target systems.

Question 41: What is the final deliverable of a professional penetration test engagement?

A summary of all tools used during the test
A list of all IP addresses scanned
Raw packet capture files from network scanning
A comprehensive written report detailing findings, risk ratings, evidence, and remediation recommendations (Correct answer)

Correct answer: A comprehensive written report detailing findings, risk ratings, evidence, and remediation recommendations

The penetration test report communicates discovered vulnerabilities with proof-of-concept evidence, CVSS risk ratings, business impact analysis, and prioritized remediation steps to help the client fix issues.

Question 42: A rootkit hides malicious processes by intercepting system calls before they reach the OS kernel. What type of rootkit is this?

Firmware rootkit
Kernel-mode rootkit (Correct answer)
Bootloader rootkit
User-mode rootkit

Correct answer: Kernel-mode rootkit

Kernel-mode rootkits operate at ring 0 and hook or patch system call tables to filter OS responses, making malicious processes and files invisible to user-space tools.

Question 43: Which best describes the scope of Automation & Scripting in professional practice?

An outdated concept no longer relevant to modern practice
A theoretical framework with no practical applications
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A narrow topic relevant only to entry-level professionals

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Automation & Scripting encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 44: Which log source on a Windows system records successful and failed logon attempts and is critical for intrusion investigations?

Setup event log
System event log
Application event log
Security event log (Correct answer)

Correct answer: Security event log

The Windows Security event log (Event IDs 4624/4625) records authentication events, making it the primary source for detecting unauthorized access attempts.

Question 45: What is the recommended approach to staying current in Operating Systems & Platforms?

Regular professional development, industry publications, and peer collaboration (Correct answer)
Relying solely on past experience
Reviewing initial training materials once per year
Waiting for regulatory changes to force updates

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Operating Systems & Platforms requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 46: A process injects code into explorer.exe to hide its presence. What technique is this?

Reflective loading
Process hollowing
DLL side-loading
Process injection (Correct answer)

Correct answer: Process injection

Process injection involves inserting malicious code into the address space of a legitimate running process to evade detection and inherit its trust level.

Question 47: Which best describes the scope of Operating Systems & Platforms in professional practice?

A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A narrow topic relevant only to entry-level professionals
A theoretical framework with no practical applications
An outdated concept no longer relevant to modern practice

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Operating Systems & Platforms encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 48: What type of vulnerability does a race condition in application code typically lead to?

SQL injection
Time-of-check to time-of-use (TOCTOU) attack (Correct answer)
Cross-Site Scripting
Path traversal

Correct answer: Time-of-check to time-of-use (TOCTOU) attack

Race conditions can lead to TOCTOU vulnerabilities, where an attacker manipulates a resource between the time it is checked and the time it is used.

Question 49: What is the relationship between Cryptography & Data Protection and ethical professional conduct?

Ethics is relevant only when legal issues arise
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
There is no connection between technical knowledge and ethics
Ethics applies only to separate, unrelated decisions

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Cryptography & Data Protection, as professional conduct and integrity underpin all aspects of practice in this field.

Question 50: What common challenge do professionals face when applying Cloud Computing & Virtualization principles?

Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)
Obtaining permission to use the principles
Finding the relevant textbook chapter
The principles are too simple to present any challenge

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Cloud Computing & Virtualization to the practical constraints and varying conditions encountered in real-world settings.

Question 51: What is the role of threat modeling in secure application development?

Identifying potential threats and vulnerabilities in an application's design (Correct answer)
Encrypting sensitive data fields in the database
Monitoring live application logs for anomalies
Automating security tests in CI/CD pipelines

Correct answer: Identifying potential threats and vulnerabilities in an application's design

Threat modeling is a structured process for identifying security threats, attack vectors, and countermeasures during the design phase before any code is written.

Question 52: What does encryption do in network security?

It protects data by making it unreadable without a decryption key (Correct answer)
It makes data accessible to everyone
It prevents data from being stored
It speeds up data transmission

Correct answer: It protects data by making it unreadable without a decryption key

Encryption is the process of converting information or data into a code to prevent unauthorized access. It scrambles data into an unreadable format, and only individuals with the correct decryption key can convert it back into its original, readable form, ensuring data confidentiality.

Question 53: What is the relationship between Operating Systems & Platforms and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
There is no connection between technical knowledge and ethics
Ethics applies only to separate, unrelated decisions
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Operating Systems & Platforms, as professional conduct and integrity underpin all aspects of practice in this field.

Question 54: What is the Common Vulnerability Scoring System (CVSS) used for?

Enumerating known exploits for vulnerabilities
Tracking vulnerability disclosure timelines
Managing bug bounty program payouts
Providing a standardized numerical score to represent the severity of a security vulnerability (Correct answer)

Correct answer: Providing a standardized numerical score to represent the severity of a security vulnerability

CVSS provides a standardized framework to score vulnerabilities from 0 to 10 based on exploitability, scope, and impact metrics, helping organizations prioritize remediation efforts.

Question 55: What is the relationship between Automation & Scripting and ethical professional conduct?

There is no connection between technical knowledge and ethics
Ethics applies only to separate, unrelated decisions
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Automation & Scripting, as professional conduct and integrity underpin all aspects of practice in this field.

Question 56: Why is it important to contain a security incident?

To remove all security protocols
To destroy all data in the system
To minimize the impact and prevent further damage (Correct answer)
To increase system vulnerabilities

Correct answer: To minimize the impact and prevent further damage

Containing a security incident is a critical step in incident response, aiming to limit the scope and severity of the attack. By isolating affected systems or networks, organizations can prevent the incident from spreading, minimize data loss, and reduce overall business disruption.

Question 57: Which technique do penetration testers use to intercept and manipulate web application traffic between a browser and server?

Password cracking with Hashcat
Port scanning with Nmap
Using a web proxy like Burp Suite as a man-in-the-middle (Correct answer)
Network sniffing with Wireshark

Correct answer: Using a web proxy like Burp Suite as a man-in-the-middle

A web proxy like Burp Suite sits between the browser and server, allowing testers to inspect, modify, and replay HTTP/HTTPS requests to test for web application vulnerabilities.

Question 58: Which best describes the scope of System Administration & Configuration in professional practice?

A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A narrow topic relevant only to entry-level professionals
An outdated concept no longer relevant to modern practice
A theoretical framework with no practical applications

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

System Administration & Configuration encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 59: Which type of malware disguises itself as legitimate software to trick users into installing it?

Trojan horse (Correct answer)
Rootkit
Worm
Ransomware

Correct answer: Trojan horse

A Trojan horse masquerades as a benign or useful application while secretly performing malicious actions once executed by the user.

Question 60: A forensic investigator uses the SHA-256 algorithm on a disk image immediately after acquisition and again after analysis. What is the purpose of this action?

Authenticating the investigator's identity
Compressing the image to save space
Verifying the image has not been tampered with (Correct answer)
Encrypting the image for secure storage

Correct answer: Verifying the image has not been tampered with

Hashing the image before and after analysis produces a cryptographic fingerprint; matching hashes prove the image was not altered, maintaining evidence integrity.

Question 61: What is the purpose of YARA rules in malware analysis?

Monitoring network traffic for C2 communications
Generating cryptographic hashes of suspicious files
Scanning files and memory for patterns that identify malware families (Correct answer)
Automatically removing malware from infected systems

Correct answer: Scanning files and memory for patterns that identify malware families

YARA rules define string and byte patterns that, when matched in a file or process, identify malware samples belonging to a specific family or campaign.

Question 62: What is a key component of a disaster recovery plan?

Increased system access restrictions
Ignoring system downtimes
Limiting the use of security tools
Backup strategies to retrieve lost data (Correct answer)

Correct answer: Backup strategies to retrieve lost data

A key component of any effective disaster recovery plan (DRP) is a robust set of backup strategies. In the event of data loss due to a disaster or cyberattack, these strategies ensure that critical information can be retrieved and restored. This includes defining what data to back up, how often, where it will be stored (e.g., offsite, cloud), and the procedures for its recovery.

Question 63: Which best describes the scope of Cryptography & Data Protection in professional practice?

An outdated concept no longer relevant to modern practice
A theoretical framework with no practical applications
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A narrow topic relevant only to entry-level professionals

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Cryptography & Data Protection encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 64: What is the first step in the risk assessment process?

Assessing vulnerabilities in existing systems
Ignoring non-critical assets
Testing existing security measures
Identifying assets and their value (Correct answer)

Correct answer: Identifying assets and their value

The first step in any cybersecurity risk assessment is to understand what needs protection. This involves identifying all critical assets—such as data, hardware, software, and intellectual property—and determining their value to the organization, as this dictates the level of protection required.

Question 65: What common challenge do professionals face when applying Monitoring & Performance Optimization principles?

The principles are too simple to present any challenge
Obtaining permission to use the principles
Finding the relevant textbook chapter
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Monitoring & Performance Optimization to the practical constraints and varying conditions encountered in real-world settings.

Question 66: Which tool is commonly used for threat detection in cybersecurity?

Firewall management system
VPN service
Intrusion detection system (IDS) (Correct answer)
Employee monitoring tools

Correct answer: Intrusion detection system (IDS)

An Intrusion Detection System (IDS) is a security tool that monitors network or system activities for malicious activity or policy violations. It detects suspicious patterns or signatures that indicate an attack or unauthorized access attempt, alerting administrators to potential threats.

Question 67: What does 'security by obscurity' mean and why is it considered insufficient?

Using complex encryption keys that are hard to guess
Hiding servers behind multiple NAT layers
Obfuscating code to prevent reverse engineering
Relying on secrecy of design or implementation as the main security mechanism, which fails once the secret is exposed (Correct answer)

Correct answer: Relying on secrecy of design or implementation as the main security mechanism, which fails once the secret is exposed

Security by obscurity relies on hiding how a system works rather than using genuine security controls, which provides no protection once an attacker discovers or leaks the design.

Question 68: What is the most important competency assessed in Operating Systems & Platforms for professionals in this field?

Applied knowledge and practical problem-solving ability (Correct answer)
Academic credentials without practical application
Memorization of textbook definitions only
Years of experience without demonstrated skill

Correct answer: Applied knowledge and practical problem-solving ability

Operating Systems & Platforms assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 69: What is a parameterized query (prepared statement) used to prevent?

Denial-of-service attacks
Privilege escalation
Buffer overflow attacks
SQL injection attacks (Correct answer)

Correct answer: SQL injection attacks

Parameterized queries separate SQL code from data, ensuring user input is always treated as a literal value and never interpreted as SQL syntax.

Question 70: What should a security policy include?

Access control, data handling, and incident response rules (Correct answer)
Staff personal preferences
Vendor management guidelines only
Only guidelines for system installation

Correct answer: Access control, data handling, and incident response rules

A comprehensive security policy should include a wide range of rules to protect an organization's assets. Key elements typically cover access control, dictating who can access what resources; data handling procedures, specifying how sensitive information should be stored, processed, and transmitted; and incident response rules, outlining steps to take during a security breach. These components collectively form a robust security framework.

Question 71: How often should a risk assessment be conducted?

Once every five years
Regularly, to adapt to new threats (Correct answer)
Only during system upgrades
Only when a major security breach occurs

Correct answer: Regularly, to adapt to new threats

Risk assessments should be conducted regularly because the threat landscape is constantly evolving with new vulnerabilities and attack methods emerging. Periodic assessments allow organizations to identify new risks, evaluate the effectiveness of existing controls, and adapt their security strategies accordingly. This proactive approach ensures that security measures remain relevant and robust against current and future threats.

Question 72: Which of the following is the best defense against CSRF attacks?

Disabling JavaScript on the client side
Enforcing strong password policies
Implementing anti-CSRF tokens in forms (Correct answer)
Using HTTPS for all form submissions

Correct answer: Implementing anti-CSRF tokens in forms

Anti-CSRF tokens are unique, secret, and unpredictable values tied to a user's session that must be included in state-changing requests, making forged requests from other sites invalid.

Question 73: Why is it important to document an incident response process?

To avoid transparency
To provide a record for future reference and analysis (Correct answer)
To reduce recovery time
To increase security vulnerabilities

Correct answer: To provide a record for future reference and analysis

Documenting an incident response process is vital for several reasons, primarily to create a comprehensive record of the incident. This documentation provides valuable data for post-incident analysis, allowing teams to understand what happened, how it was handled, and what improvements are needed. It also serves as a reference for future incidents, training, and demonstrating due diligence for compliance purposes.

Question 74: Malware uses domain generation algorithms (DGA) to communicate with its C2 server. What is the main benefit to the attacker?

Encrypting all C2 traffic to prevent interception
Bypassing firewall rules by using port 80
Hiding the malware inside legitimate domains
Generating random domains daily to evade static blocklists (Correct answer)

Correct answer: Generating random domains daily to evade static blocklists

DGA dynamically generates many pseudo-random domain names, so defenders cannot block C2 by blacklisting a single domain — the attacker only needs to register one.

Question 75: What is the role of a business continuity plan in disaster recovery?

To ensure that essential business functions continue (Correct answer)
To limit external communication
To reduce employee training time
To increase the likelihood of a system crash

Correct answer: To ensure that essential business functions continue

A business continuity plan (BCP) works hand-in-hand with a disaster recovery plan by focusing on maintaining essential business operations during and after a disruptive event. While DRP deals with IT system recovery, BCP ensures that critical business functions, processes, and services can continue to operate with minimal interruption. This holistic approach helps an organization survive and recover from significant incidents.

Question 76: Which Wireshark display filter would capture only DNS traffic for network forensics?

icmp.type == 53
tcp.port == 53
dns (Correct answer)
udp.port == 53

Correct answer: dns

The 'dns' display filter in Wireshark specifically isolates DNS protocol traffic regardless of the transport layer, making it the most direct filter.

Question 77: What is the primary purpose of a forensic disk image (e.g., an E01 or raw DD image)?

To create a bit-for-bit copy of storage media for analysis (Correct answer)
To compress evidence for courtroom presentation
To encrypt data before chain-of-custody transfer
To back up user files for recovery

Correct answer: To create a bit-for-bit copy of storage media for analysis

A forensic image captures every bit of the source media, including deleted files and slack space, allowing analysis without touching the original evidence.

Question 78: What is the OWASP Testing Guide primarily used for?

Providing a comprehensive methodology for web application security testing (Correct answer)
Automating network penetration tests
Configuring firewalls and IDS systems
Managing vulnerability disclosure programs

Correct answer: Providing a comprehensive methodology for web application security testing

The OWASP Testing Guide provides a structured framework with test cases for identifying security vulnerabilities in web applications, covering authentication, authorization, input validation, and more.

Question 79: What is the purpose of risk assessment in cybersecurity?

To avoid assessing security threats
To increase security vulnerabilities
To ignore potential vulnerabilities
To identify, assess, and prioritize risks (Correct answer)

Correct answer: To identify, assess, and prioritize risks

Risk assessment in cybersecurity is the process of identifying potential threats and vulnerabilities, evaluating the likelihood and impact of their exploitation, and then prioritizing these risks. This allows organizations to make informed decisions about where to allocate resources for security measures.

Question 80: Why are audits important for security policy compliance?

To delay compliance efforts
To verify adherence to security policies and regulations (Correct answer)
To ignore security protocols
To reduce documentation

Correct answer: To verify adherence to security policies and regulations

Audits are critical for security policy compliance as they provide an independent and objective assessment of an organization's adherence to its established security policies and relevant regulations. They help verify that security controls are implemented correctly and operating effectively. This verification process identifies any deviations or non-compliance, allowing for corrective actions to be taken and ensuring a strong security posture.

Question 81: What does a firewall do in network security?

It encrypts all network data
It speeds up network traffic
It provides backup power for the network
It filters and blocks harmful traffic (Correct answer)

Correct answer: It filters and blocks harmful traffic

A firewall acts as a barrier between a trusted internal network and untrusted external networks, like the internet. It examines incoming and outgoing network traffic against a set of predefined security rules, blocking malicious data packets and preventing unauthorized access.

Question 82: What is the role of incident response policies in an organization?

To define a structured response to security incidents (Correct answer)
To delay security updates
To avoid training employees
To minimize risk of network downtime

Correct answer: To define a structured response to security incidents

Incident response policies are critical because they provide a clear, structured framework for how an organization will react to and manage security incidents. These policies define roles, responsibilities, communication protocols, and steps to be taken from detection to recovery. A well-defined policy ensures a coordinated, efficient, and effective response, minimizing damage and recovery time.

Question 83: Which best describes the scope of Access Control & Identity Management in professional practice?

A narrow topic relevant only to entry-level professionals
An outdated concept no longer relevant to modern practice
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A theoretical framework with no practical applications

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Access Control & Identity Management encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 84: What is the purpose of incident recovery in cybersecurity?

To identify the root cause of the breach
To monitor user behavior
To restore normal operations as quickly as possible (Correct answer)
To reduce the risk of future breaches

Correct answer: To restore normal operations as quickly as possible

Incident recovery is a critical phase in cybersecurity incident management, focusing on restoring affected systems and services to their normal operational state. The primary objective is to minimize downtime and ensure business continuity as quickly and efficiently as possible. This involves activities like data restoration, system re-configuration, and verifying the integrity of recovered assets.

Question 85: Which best describes the scope of Emerging Technologies & Trends in professional practice?

An outdated concept no longer relevant to modern practice
A theoretical framework with no practical applications
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A narrow topic relevant only to entry-level professionals

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Emerging Technologies & Trends encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 86: What is 'fuzzing' as a security testing technique?

Intercepting encrypted HTTPS traffic using a proxy
Scanning for misconfigured cloud storage buckets
Enumerating user accounts through brute force
Sending large volumes of random, malformed, or unexpected input to an application to trigger crashes or unexpected behavior (Correct answer)

Correct answer: Sending large volumes of random, malformed, or unexpected input to an application to trigger crashes or unexpected behavior

Fuzzing (fuzz testing) involves feeding random, invalid, or unexpected inputs to an application to discover crashes, memory leaks, or unexpected behaviors that may indicate exploitable vulnerabilities.

Question 87: What role does a disaster recovery plan play in incident management?

It helps restore critical systems and data quickly (Correct answer)
It is not necessary for incident management
It prevents security breaches
It delays the incident response process

Correct answer: It helps restore critical systems and data quickly

A disaster recovery plan (DRP) is crucial for incident management because its primary goal is to minimize disruption and quickly restore operations after a catastrophic event. It outlines the procedures and resources needed to recover critical IT infrastructure, systems, and data. By having a well-defined DRP, organizations can ensure business continuity and reduce the financial and reputational impact of an incident.

Question 88: What is the correct order of volatility when collecting digital evidence, starting with the most volatile?

Hard disk, RAM, CPU registers, network traffic
Network traffic, RAM, CPU registers, hard disk
CPU registers, RAM, network traffic, hard disk (Correct answer)
RAM, hard disk, CPU registers, network traffic

Correct answer: CPU registers, RAM, network traffic, hard disk

CPU registers and cache are lost instantly on power-off, followed by RAM, then active network connections, with persistent disk storage being least volatile.

Question 89: What is the most important competency assessed in System Administration & Configuration for professionals in this field?

Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)
Years of experience without demonstrated skill
Academic credentials without practical application

Correct answer: Applied knowledge and practical problem-solving ability

System Administration & Configuration assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 90: What is the recommended approach to staying current in Cryptography & Data Protection?

Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year
Waiting for regulatory changes to force updates
Relying solely on past experience

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Cryptography & Data Protection requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 91: How does Automation & Scripting contribute to overall professional effectiveness?

It is relevant only during the certification examination
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Automation & Scripting directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Certified Cybersecurity Technician (CCT) Exam

The CCT exam validates foundational knowledge and practical skills in cybersecurity, preparing individuals for entry-level roles in the field.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds