Study Cisco CCST Cybersecurity endpoint security: malware, patching, hardening, secure configuration, device management, and safe support actions.
Endpoint, Device, and Secure Configuration questions test practical support judgment. You should recognize risky endpoint behavior, hardening choices, patching needs, malware signals, and safe ways to manage devices.
| Risk | Better security response |
|---|---|
| missing patches | update through approved patch process |
| unknown USB device | do not connect; follow device policy |
| malware alert | isolate or contain according to playbook, preserve evidence, escalate |
| local admin everywhere | reduce privileges and use approved admin workflow |
| default password | change credentials and document ownership |
| exposed management interface | restrict access and use secure management |
Hardening means reducing unnecessary attack surface. CCST-level hardening includes disabling unused services, applying patches, changing default credentials, using MFA where supported, restricting administrative access, enabling host firewall protections, logging important events, and keeping endpoint protection active.
| Clue | What to collect |
|---|---|
| suspicious process | process name, parent process, path, hash if available |
| outbound connection | destination, port, protocol, time, process |
| antivirus or EDR alert | alert name, host, user, file, action taken |
| unusual login | user, source, time, MFA result, privilege |
| ransomware note | affected host, files, time, network connections, business impact |
Administrative access should use approved methods such as SSH, management platforms, or controlled consoles. Do not manage production systems through shared passwords, personal accounts, open management ports, or undocumented changes. If a task requires higher privilege, escalate with evidence instead of improvising.