100-160 Exam Dumps : Cisco Certified Support Technician (CCST) Cybersecurity

TheCCST Cybersecuritycourse notes that isolation is a key part of thecontainment phaseof incident response. The goal is to prevent the compromised system from communicating with the attacker or spreading malware, while preserving it for analysis.

"Containment often involves removing an affected system from the production network and connecting it to a controlled forensic environment to preserve evidence and prevent further compromise."

(CCST Cybersecurity,Incident Handling, Containment Procedures section, Cisco Networking Academy)

TheCCST Cybersecurity Study Guideoutlines the standardrisk management processin the following sequence:

Identify the risks–

"Determine potential threats and vulnerabilities that could negatively impact organizational assets."

Prioritize the risks–

"Assess each risk in terms of likelihood and potential impact to rank them for remediation."

Implement a response–

"Apply the appropriate mitigation, transfer, acceptance, or avoidance strategy to address each prioritized risk."

Monitor results–

"Continuously assess the effectiveness of implemented controls and make adjustments as needed."

(CCST Cybersecurity,Vulnerability Assessment and Risk Management, Risk Management Process section, Cisco Networking Academy)

TheCCST Cybersecurity Study Guidedescribes theDiamond Model of Intrusion Analysisas a framework to map the relationships between four core features of an intrusion:

Adversary– The threat actor or group conducting the attack.

Example: Ransomware Group

Capability– The tools, techniques, or malware the adversary uses.

Example: Phishing Email, Malware

Infrastructure– The physical or logical communication and delivery systems the adversary uses.

Example: Email Server, Domain Name

Victim– The target of the attack, such as systems, organizations, or individuals.

Example: Customer and Product Databases

"The Diamond Model helps analysts connect the attacker, the tools they use, the infrastructure supporting the attack, and the victim, providing a holistic view of the intrusion event."

(CCST Cybersecurity,Incident Handling, Threat Modeling section, Cisco Networking Academy)