Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Cisco
Exam Format
Registration
Validity
Skills this practice test covers
- Explain the CIA triad, defense-in-depth and the difference between a threat, an exploit and a risk.
- Describe weaknesses in TCP/IP protocols such as ARP, DHCP and DNS, and how attackers use them.
- Secure a small office wireless network and explain where ACLs, firewalls and VPNs fit.
- Gather endpoint information with netstat, nslookup and tcpdump, and read Event Viewer logs.
- Rank risks and separate a disaster recovery plan from a business continuity plan.
- Decide when a security event needs escalation and how evidence should be handled.
Explore related topics
100-160 exam content
5 domains · 23 topics · 140 questions
Essential Security Principles28 questions
This domain sets out the vocabulary of security: threats, vulnerabilities, exploits and risks, the CIA triad and defense-in-depth. It also covers common attacks, access management with AAA and MFA, and the main encryption methods.
Skills tested
- Define vulnerabilities, threats, exploits and risks, and give an example of each.
- Recognize malware, ransomware, botnets, social engineering and man-in-the-middle attacks.
- Explain AAA, RADIUS, multifactor authentication and strong password policies.
- Compare symmetric and asymmetric encryption, hashing, certificates and PKI.
Questions by topic
- Define essential security principles7
- Explain common threats and vulnerabilities5
- Explain access management principles7
- Explain encryption methods and applications9
Basic Network Security Concepts31 questions
Here the focus moves to the network. Candidates describe weaknesses in TCP/IP protocols, explain how addressing and segmentation affect security, and recognize controls such as a DMZ, intrusion detection and prevention systems (IDS and IPS), ACLs, firewalls, VPNs and NAC.
Skills tested
- Describe attacks on TCP, UDP, HTTP, ARP, ICMP, DHCP and DNS.
- Explain how IP and MAC addresses, NAT and network segmentation affect security.
- Set up a secure wireless SoHo network with strong encryption, a sensible SSID and MAC address filtering.
- Explain where ACLs, firewalls, VPNs and network access control fit in a network.
Questions by topic
- Describe TCP/IP protocol vulnerabilities7
- Explain how network addresses impact network security5
- Describe network infrastructure and technologies7
- Set up a secure wireless SoHo network6
- Implement secure access technologies6
Endpoint Security Concepts37 questions
This domain is about the devices people work on. Candidates compare Windows, macOS and Linux security features, use endpoint tools, check that devices meet policy, apply updates, read system logs and remove malware.
Skills tested
- Use netstat, nslookup and tcpdump to gather security information from an endpoint.
- Check file and directory permissions and spot privilege escalation risks.
- Verify hardware and software inventory, backups, BYOD rules and regulatory compliance.
- Apply Windows Update, application, driver and firmware updates.
- Read Event Viewer, audit and syslog entries to find anomalies, then scan for and remove malware.
Questions by topic
- Describe operating system security concepts8
- Demonstrate familiarity with appropriate endpoint tools that gather security assessment information6
- Verify that endpoint systems meet security policies and standards6
- Implement software and hardware updates6
- Interpret system logs5
- Demonstrate familiarity with malware removal6
Vulnerability Assessment and Risk Management25 questions
This domain covers finding weaknesses before attackers do and deciding what to fix first. Candidates explain vulnerability management, use threat intelligence and CVEs, rank risks, and plan for disaster recovery and business continuity.
Skills tested
- Explain vulnerability management, including active and passive reconnaissance and port scanning.
- Use vulnerability databases and CVE entries, and know their limits.
- Rank risks and choose an approach for managing each one.
- Separate a disaster recovery plan from a business continuity plan, and explain the role of backups in each.
Questions by topic
- Explain vulnerability management6
- Use threat intelligence techniques to identify potential network vulnerabilities6
- Explain risk management7
- Explain the importance of disaster recovery and business continuity planning6
Incident Handling19 questions
The last domain covers what happens after an alert. Candidates monitor events with SIEM and SOAR tools, know when to escalate, explain attack frameworks and evidence handling, and follow compliance and incident response rules.
Skills tested
- Monitor security events and decide when an event needs escalation.
- Explain the Cyber Kill Chain, the MITRE ATT&CK Matrix and the Diamond Model.
- Describe sources of evidence and how to handle them during an investigation.
- Describe the incident response lifecycle in NIST SP 800-61 and the reporting rules of compliance frameworks.
Questions by topic
- Monitor security events and know when escalation is required4
- Explain digital forensics and attack attribution processes6
- Explain the impact of compliance frameworks on incident handling4
- Describe the elements of cybersecurity incident response5
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: cybersecurity instruction with plenty of hands-on practice.
- Recommended: a basic grasp of security principles, network security and endpoint security.
About the 100-160 exam
The 100-160 exam checks the security basics that an entry-level technician needs, from the CIA triad and encryption to reading logs and knowing when to escalate an incident. Candidates also work with network protections such as access control lists (ACLs), firewalls and VPNs, endpoint tools such as netstat and tcpdump, and the basics of risk management. Passing earns the Cisco Certified Support Technician (CCST) Cybersecurity certification.
Endpoint Security Concepts has the most questions in the PlanetCert practice test, from Windows Defender and file permissions to Event Viewer and malware removal. The explanations tie terms to what a technician would see on a real device, such as an unknown listening port in netstat output. Flashcard mode suits the many acronyms in Essential Security Principles, such as AAA, MFA and PKI. Brainy AI Assistant can explain how the Cyber Kill Chain differs from the MITRE ATT&CK Matrix, or walk through a risk ranking.
How to earn the certification
- Earns
- Cisco Certified Support Technician (CCST) CybersecurityEntry-Level
CCST Cybersecurity earned on or after July 15, 2025 is valid for five years; holders who passed before that date keep lifetime validity.
- After
- 200-201 CCNA Cybersecurity (CyberOps Associate)
Cisco's associate-level exam for security operations work, the usual next step after CCST Cybersecurity.
- 200-301 Cisco Certified Network Associate (CCNA)
Cisco's associate networking exam, for those who move toward network roles.
- 200-201 CCNA Cybersecurity (CyberOps Associate)
How to prepare for 100-160
- 1
Put each principle in plain words
Write one plain sentence for each idea in Essential Security Principles, such as exploit, risk and defense-in-depth. Then match each common attack to the control that stops it.
- 2
Run the endpoint tools on a laptop
Use netstat, nslookup and tcpdump on a home computer, and read the Event Viewer or syslog entries after a login. Endpoint Security Concepts has the most questions in the practice test.
- 3
Secure a home wireless router
Change the SSID, turn on strong wireless encryption and try MAC address filtering on a SoHo router. Note what each setting protects against and what it does not.
- 4
Walk one alert through NIST
Take a sample alert through the NIST SP 800-61 incident response lifecycle, from detection to lessons learned. Decide at which point it needs escalation and which evidence to keep.
- 5
Finish with flashcards and a timed run
Use Flashcard mode for acronyms such as SOAR, BIA and RPO, then take the 100-160 practice test in Timed Mode. Ask Brainy AI Assistant to explain any risk or framework question that went wrong.
Start a timed 100-160run
Who 100-160 is for
- Students in secondary school, college or technical school who are learning cybersecurity.
- Entry-level IT and networking staff who take on security tasks.
- People moving into IT who want proof of basic security knowledge.
- Learners who plan to continue to CCNA Cybersecurity.
Typical job titles: Junior security analyst · SOC analyst · IT support technician · Help desk technician · Junior network technician
100-160 glossary
20 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Authentication, authorization, and accounting (AAA)
- A three-part model: confirm a user's identity, grant the right permissions, and log the user's activity.
- Common Vulnerabilities and Exposures (CVEs)
- A public list that gives each known vulnerability a unique ID, so that teams can track it.
- Confidentiality, integrity, and availability (CIA)
- The three goals of security: keep data secret, keep it accurate, and keep systems usable when they are needed.
- Cyber Kill Chain
- A model that breaks an attack into stages, from reconnaissance to actions on the target.
- Defense-in-depth
- Layering several security controls, so that one failed control does not expose the whole system.
- Diamond Model
- An analysis model that links four parts of an attack: the adversary, its capability, its infrastructure and the victim.
- DMZ
- A separate network zone for public-facing servers, placed between the internet and the internal network.
- Event Viewer
- The Windows tool for reading system, security and application logs.
- Honeypot
- A decoy system set up to attract attackers, so that their methods can be watched.
- MITRE ATT&CK Matrix
- A public catalog of attacker tactics and techniques, arranged by the goal that each one serves.
- Multifactor authentication (MFA)
- A login that needs two or more kinds of proof, such as a password plus a code from a phone.
- NAC
- Network access control: it checks a device before the device joins the network, and blocks or limits it if it fails policy.
- netstat
- A command that lists a computer's active network connections and listening ports.
- nslookup
- A command that queries DNS to find the address behind a name, or the name behind an address.
- Public key infrastructure (PKI)
- The system of certificate authorities that issue and sign certificates, so that a public key can be trusted.
- RADIUS
- A protocol that sends login requests from network devices to a central server, which checks them.
- SIEM
- Security information and event management: a system that gathers logs in one place and alerts staff to suspicious patterns.
- SOAR
- Security orchestration, automation and response: tools that carry out response steps, such as blocking an address, automatically.
- Syslog
- A standard for sending log messages from devices to a central server, each message with a severity level.
- tcpdump
- A command-line packet analyzer that captures network traffic so that it can be inspected.
Related practice tests
- 300-535Automating and Programming Cisco Service Provider Solutions (SPAUTO)
- 200-901CCNA Automation (DevNet Associate)
- 200-201CCNA Cybersecurity (CyberOps Associate)
- 200-301Cisco Certified Network Associate (CCNA)
- 300-420Designing Cisco Enterprise Networks (ENSLD)