The CCST Cybersecurity exam and security roles

Jordan Pelletier had been at Brightline IT Services in Saskatoon for just over two months when Owen Larkin, the owner, called him into the small meeting room with the whiteboard that never quite erases. Jordan had spent September and October on the help desk with Marisol Tran, resetting passwords, swapping failed drives and learning to write tickets that someone else could understand. He had booked his CCST IT Support exam for early in the new year. Owen wanted to talk about what came next. Brightline's clients were asking more security questions every month, and the company's one security analyst, Keisha Moreau, could not answer them all.

Owen's plan was simple. Jordan would keep his help desk shifts, but two afternoons a week he would shadow Keisha. Along the way he would prepare for the Cisco Certified Support Technician Cybersecurity exam, known by its code 100-160. Keisha would be his mentor for the security side, the way Marisol had been for support. This course follows those afternoons. It covers the first half of the exam: security principles, threats and the basic ideas of protecting a network. CSCO-122 covers the second half: endpoints, vulnerability management, risk and incident handling.

What the CCST Cybersecurity certification is

The CCST certifications are Cisco's entry-level credentials. They sit below the CCNA and are aimed at people starting out: students, career changers and technicians who support networks and users but are not yet network engineers. There are CCST exams for IT support, networking and cybersecurity. Each is a single exam, and passing it earns the certification. Cisco positions the cybersecurity exam as a way to show that a candidate understands core security concepts well enough to work in an entry-level role such as a security operations centre analyst, a help desk technician with security duties, or a junior security administrator at a small organization.

Cisco's exam page describes the exam as testing knowledge of security principles, network security and endpoint security concepts, vulnerability assessment and risk management, and incident handling. When this course was written, that page gave the duration as 50 minutes and the price as 125 US dollars, and listed several languages, including English, French and Spanish. Prices, languages and policies change, so check the current page before you book. Training providers commonly describe the exam in five domains, and that grouping is a useful study map even though Cisco's own exam topics document is the authority.

The number of questions and the passing score are not stated on Cisco's exam page. Secondary sources commonly report 40 to 50 questions and say that Cisco does not publish a pass mark; score reports show pass or fail with feedback by section. Treat any precise figure you read elsewhere with caution. The CCST Exam Readiness course, CSCO-190, covers booking, item types and time management in detail. For now, the useful fact is that 50 minutes for roughly 40 to 50 items leaves about a minute per question, so recognition and clear understanding matter more than slow working-out.

Who works in security

Keisha started her first afternoon with Jordan by drawing the people who do security work. At the top of her drawing was the board and senior management, who own risk and decide how much of it the organization will accept. Below them was a security leader, often called a chief information security officer in large organizations and simply "whoever does security" in small ones. Then came the people who build and run defences, the people who watch for attacks, and the people who check that everything is working. In a company of 14 people like Brightline, one person may wear four of those hats, which is exactly why Keisha needed help.

Entry-level roles are where most people start. A security operations centre, or SOC, analyst watches alerts from monitoring tools, decides which are real, and escalates the serious ones. SOCs often describe analysts in tiers: tier 1 triages alerts, tier 2 investigates incidents in depth, and tier 3 hunts for threats that tools have missed. A security administrator configures firewalls, accounts, permissions and security tools. A help desk technician with security duties resets accounts safely, spots phishing, and handles lost devices. Other roles include vulnerability analyst, governance and compliance analyst, penetration tester, and security engineer. The CCST is aimed at the first rungs of this ladder.

The defender's mindset

Keisha told Jordan that the most important thing she could teach him was not a tool but a habit of mind. Attackers look for the easiest way in. Defenders have to think about every way in, so they rely on layers, so that one failure does not mean total failure. This idea is called defence in depth. A small business might have a firewall at the edge, separate networks for different kinds of devices, strong sign-in for every account, up-to-date software, backups, and staff who know how to report a suspicious email. No single layer is perfect. Together they make an attack slower, noisier and more likely to fail.

The second habit is skepticism about trust. Older network designs assumed that anything inside the office was safe. Modern guidance, often summed up as zero trust, assumes that a device or user is not trusted just because of where it sits on the network. Every request is checked: who is asking, from what device, for what resource, and whether that makes sense right now. Zero trust is a direction rather than a product, and most small organizations move toward it gradually, starting with strong sign-in and separating their networks.

The third habit is writing things down. Marisol's favourite phrase on the help desk, "write it down", matters even more in security. Changes to firewall rules, exceptions to policy, the reason an account was given extra access, and every step taken during an incident all need a record. When something goes wrong, the record is how the team reconstructs what happened. When an auditor or insurer asks, the record is the evidence that controls exist.

Ethics and the law

Security work gives people access and knowledge that could cause harm. A technician who can reset passwords can also read mail. An analyst who studies attacks can, in principle, carry one out. For that reason security has strong professional ethics. The core rules are simple: act only within your authorization, protect the privacy of the people whose data you see, report problems honestly, and never test or probe systems you do not have written permission to test. Many certification bodies, including Cisco, require candidates to agree to a code of conduct, and breaking exam rules or misusing knowledge can cost a certification.

The law matters too. In Canada, the Criminal Code makes unauthorized use of a computer an offence, and privacy laws such as the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's private-sector law and provincial health information laws such as Saskatchewan's Health Information Protection Act set rules for handling personal information and reporting breaches. Jordan did not need to be a lawyer, Keisha said, but he did need to know that these rules exist, that Brightline's clients are bound by them, and that the right response to a possible breach is to escalate quickly rather than quietly fix it.

National cyber security agencies

Each country has public agencies that publish free guidance, alerts and advice for small organizations. In Canada the Canadian Centre for Cyber Security, part of the Communications Security Establishment, publishes advisories, baseline controls for small and medium organizations and awareness material. Police services and the Canadian Anti-Fraud Centre take reports of cybercrime and fraud. Keisha subscribes to the agency's alerts and reads them each morning with her coffee. She told Jordan to do the same; it is the cheapest threat intelligence available.

Frameworks give structure to all of this. The NIST Cybersecurity Framework, published in the United States and widely used in Canada as well, organizes security work into functions: govern, identify, protect, detect, respond and recover. Brightline uses those functions to explain its services to clients. Lessons in this course mostly sit in the identify and protect functions; CSCO-122 spends more time on detect, respond and recover.