$5one-time
- 38-page printable PDF
- 182 terms with examples
- 44 practice questions, answers explained
- 2-page cram sheet and study plans
← DSST Fundamentals of Cybersecurity course
DSST® Study Guide
Printable PDF · 38 pages
DSST Fundamentals of Cybersecurity Study Guide
Everything the DSST Fundamentals of Cybersecurity exam tests, in one PDF you can print. Built from Prometric's official outline, heaviest topics first.
- 182 key terms, each with an example
- 44 practice questions with every answer explained
- A 2-page cram sheet for the night before
- 2-, 4- and 8-week study plans built from the exam weights
Last updated 2026 · exam details checked against Prometric's published exam information in 2026
Look inside the guide
Real pages from the 38-page PDF.
What you get for $5
One chapter for each official content area, in the order the exam weighs them.
- 📘38pages, printable
- 🧭8chapters, heaviest first
- 🔑182terms with examples
- ✍️44practice questions, answers explained
- ⚠️22exam traps to avoid
- 📄2page cram sheet
Try 10 free Fundamentals of Cybersecurity questions
In the style of the real exam, from all 8 areas. About 10 minutes, with every answer explained and a score by area.
10 questions
-
Question 1 · Vulnerability Management
A security firm is hired to test a company's network. The company gives the testers a standard employee account and a short list of subnets, but no source code or detailed diagrams. Which type of penetration test is this?
Show the answer
Answer: B. Gray-box. The testers have some, but not all, information about the target. Partial knowledge defines a gray-box test.
The trap: Black-box is tempting because the testers lack source code, but a black-box tester starts with no inside information, not even an account.
The testers have some, but not all, information about the target. Partial knowledge defines a gray-box test.
The trap: Black-box is tempting because the testers lack source code, but a black-box tester starts with no inside information, not even an account.
-
Question 2 · Network Security
A company hosts a public website and an internal payroll database. Where should the web server be placed so that a compromise of it gives the least access to payroll?
Show the answer
Answer: D. In a DMZ separated from the internal network. A DMZ keeps public-facing servers on a separate segment, so a compromised web server has no direct path to internal systems.
The trap: Placing it on the same subnet as the payroll database is wrong because a breach of the web server would put the database one hop away.
A DMZ keeps public-facing servers on a separate segment, so a compromised web server has no direct path to internal systems.
The trap: Placing it on the same subnet as the payroll database is wrong because a breach of the web server would put the database one hop away.
-
Question 3 · Application & Systems Security
A payroll clerk quietly changes her own salary in a database. The auditors discover the figure no longer matches the approved amount. Which security goal was violated?
Show the answer
Answer: C. Integrity. Integrity means data stays accurate and changes only through authorized actions. An unauthorized edit of an approved value breaks it.
The trap: Confidentiality is tempting because the clerk touched sensitive data, but nothing was disclosed. The problem is that the stored value was altered.
Integrity means data stays accurate and changes only through authorized actions. An unauthorized edit of an approved value breaks it.
The trap: Confidentiality is tempting because the clerk touched sensitive data, but nothing was disclosed. The problem is that the stored value was altered.
-
Question 4 · Authentication, Authorization, & Access Controls
A payment system lets the same accounts-payable employee create a new vendor and also approve payments to that vendor. An auditor says this invites fraud. Which control would most directly fix the problem?
Show the answer
Answer: A. Splitting vendor setup and payment approval between two different employees. Fraud is possible because one person controls a whole critical task. Dividing the steps between two people is separation of duties, so a single person cannot commit and hide the fraud.
The trap: Smart cards strengthen authentication, but the problem is not who the employee is. It is that she holds too much power.
Fraud is possible because one person controls a whole critical task. Dividing the steps between two people is separation of duties, so a single person cannot commit and hide the fraud.
The trap: Smart cards strengthen authentication, but the problem is not who the employee is. It is that she holds too much power.
-
Question 5 · Compliance & Governance
A server is worth $200,000. Analysts estimate that a single ransomware incident would destroy 25% of its value and expect one incident every two years. What is the annualized loss expectancy?
Show the answer
Answer: C. $25,000. Single loss expectancy is $200,000 × 0.25 = $50,000. The annual rate of occurrence is 0.5, so annualized loss expectancy is $50,000 × 0.5 = $25,000.
The trap: $50,000 is the single loss expectancy. It is tempting because it is an intermediate result, but it was not multiplied by the annual rate of occurrence.
Single loss expectancy is $200,000 × 0.25 = $50,000. The annual rate of occurrence is 0.5, so annualized loss expectancy is $50,000 × 0.5 = $25,000.
The trap: $50,000 is the single loss expectancy. It is tempting because it is an intermediate result, but it was not multiplied by the annual rate of occurrence.
-
Question 6 · Disaster Recovery & Business Continuity
A company's order system takes a copy of its data every two hours. After a failure, it can restore only to the last copy. Management says no more than 30 minutes of transactions may be lost. What does this requirement describe?
Show the answer
Answer: A. The recovery point objective. The recovery point objective is the maximum acceptable data loss measured in time. Thirty minutes is the limit, so the two-hour copy schedule does not meet it.
The trap: The recovery time objective is tempting since both are measured in time, but it states how long restoration may take, not how much data may be lost.
The recovery point objective is the maximum acceptable data loss measured in time. Thirty minutes is the limit, so the two-hour copy schedule does not meet it.
The trap: The recovery time objective is tempting since both are measured in time, but it states how long restoration may take, not how much data may be lost.
-
Question 7 · Operational Security
A company's servers, firewalls and applications each store logs separately. Analysts want one system to pull them together, connect related events across devices, and alert when a pattern looks like an attack. What should they deploy?
Show the answer
Answer: B. A security information and event management system. A SIEM collects logs from many sources, correlates events and generates alerts. That is exactly the stated need.
The trap: A data loss prevention gateway is tempting because it also watches traffic, but it blocks sensitive data from leaving and does not correlate logs from many devices.
A SIEM collects logs from many sources, correlates events and generates alerts. That is exactly the stated need.
The trap: A data loss prevention gateway is tempting because it also watches traffic, but it blocks sensitive data from leaving and does not correlate logs from many devices.
-
Question 8 · Physical & Environmental Security
A visitor without a badge waits near a secure side entrance. When an employee badges in, the visitor catches the door before it closes and walks in unnoticed. Which term describes this?
Show the answer
Answer: D. Tailgating. Tailgating is slipping into a secured area behind an authorized person, without credentials and without that person's knowledge.
The trap: A mantrap is the control designed to stop this, so it is not the name of the event. It admits one person at a time.
Tailgating is slipping into a secured area behind an authorized person, without credentials and without that person's knowledge.
The trap: A mantrap is the control designed to stop this, so it is not the name of the event. It admits one person at a time.
-
Question 9 · Vulnerability Management
Within minutes of one workstation opening an infected attachment, hundreds of other computers on the network are infected. Nobody on those machines ran any file. The malware is spreading through an unpatched network service. What type of malware is it?
Show the answer
Answer: C. Worm. Malware that copies itself across a network without user action or a host file is a worm.
The trap: A virus is tempting because the first infection came from an attachment, but the spread to other machines needed no one to run anything. That is worm behavior.
Malware that copies itself across a network without user action or a host file is a worm.
The trap: A virus is tempting because the first infection came from an attachment, but the spread to other machines needed no one to run anything. That is worm behavior.
-
Question 10 · Network Security
Several customers at a cafe connect to a Wi-Fi network that has the cafe's exact name but a stronger signal. It was set up by someone sitting in the parking lot. What is this attack called?
Show the answer
Answer: A. Evil twin. An evil twin is a malicious access point that copies a legitimate network's name to lure users into connecting so their traffic can be intercepted.
The trap: A rogue access point is tempting, but it is an unauthorized device plugged into the organization's own network, not a copy of a legitimate public network.
An evil twin is a malicious access point that copies a legitimate network's name to lure users into connecting so their traffic can be intercepted.
The trap: A rogue access point is tempting, but it is an unauthorized device plugged into the organization's own network, not a copy of a legitimate public network.
The DSST Fundamentals of Cybersecurity exam at a glance
The DSST Fundamentals of Cybersecurity exam is a 120-minute, computer-based test from Prometric with about 100 multiple-choice questions. A score of 400 on the 200–500 scale earns an ACE credit recommendation of 3 semester hours, though each college sets its own policy. The exam covers 8 content areas; the heaviest is Vulnerability Management at 17%.
- Questions
- About 100multiple choice
- Time
- 120 minabout 72 seconds a question
- Passing score
- 400on a 200–500 scale
- ACE credit
- 3semester hours
- Exam fee
- $100paid to Prometric
- Calculator
- Nonot allowed
Source: official DSST Fundamentals of Cybersecurity exam page.
What the exam covers
8 areas, heaviest first. The guide's chapters follow this order.
- Vulnerability Management17%
- Network Security16%
- Application & Systems Security15%
- Authentication, Authorization, & Access Controls12%
- Compliance & Governance12%
- Disaster Recovery & Business Continuity12%
- Operational Security10%
- Physical & Environmental Security6%
How it works
- 1Buy once, $5Secure checkout. No subscription needed.
- 2Download the PDFFrom your TransferCredit.org account, right away and any time later.
- 3Study the heaviest areas firstFollow the 2-, 4- or 8-week plan, then read the cram sheet the night before.
Questions students ask
What's in the full DSST Fundamentals of Cybersecurity study guide?
38 pages: 8 chapters, one per official content area, heaviest first. 182 terms, each with a plain-English definition and an example, 14 key people, common traps and memory tricks, 44 practice questions with an answer key that explains every answer, question tactics, 2-, 4- and 8-week study plans and a 2-page cram sheet.
How much is the full DSST Fundamentals of Cybersecurity study guide?
The full 38-page PDF is $5, a one-time payment. The 10 practice questions on this page are free, with no account.
What does the $29 plan include?
$29 a month gives you all DSST subjects: every DSST study guide plus the full prep course for each subject, and you can cancel anytime. If you only need this exam, the guide on its own is a one-time $5.
How do I get the full guide?
Choose Buy this guide ($5) and check out. Then sign in to your TransferCredit.org account, then open the course and its Download Your Study Guide lesson. The PDF is yours to keep, and you can download it again from your account at any time.
Can I print the guide or use it on my phone?
Yes. It's a PDF, so it opens on phones, tablets and computers, and printing is allowed. Its tick boxes and answer bubbles work in PDF readers that support forms. Copying and editing are turned off.
Is this an official DSST study guide?
No. DSST® is a registered trademark of Prometric, which was not involved in producing this guide and does not endorse it. TransferCredit.org is independent. We built the guide from the official exam outline, and the exam details were checked against Prometric's published exam information in 2026.
Why is this study guide better than a generic review?
It follows the official outline area by area and spends the most pages on what the exam weighs most. Every term comes with an example, each chapter names the traps the exam sets, and the answer key explains why the most tempting wrong answer is wrong, not just which answer is right. It ends with a 2-page cram sheet for the night before.
What is the DSST Fundamentals of Cybersecurity exam?
The DSST Fundamentals of Cybersecurity exam is a 120-minute, computer-based test from Prometric with about 100 multiple-choice questions. A score of 400 on the 200–500 scale earns an ACE credit recommendation of 3 semester hours, though each college sets its own policy. The exam covers 8 content areas; the heaviest is Vulnerability Management at 17%.
More questions about the DSST Fundamentals of Cybersecurity exam (23)
How many questions are on the DSST Fundamentals of Cybersecurity exam, and how long is it?
It has 100 questions to be answered in 2 hours, and the ACE-recommended minimum score is 400 for 3 semester hours of lower-level baccalaureate credit.
What is the passing score for DSST Fundamentals of Cybersecurity?
The passing score is 400 on a 200–500 scale. At 400 or above, the American Council on Education (ACE) recommends 3 semester hours. Each college sets its own passing score and credit award, so check your school's policy before you book.
How much does the DSST Fundamentals of Cybersecurity exam cost?
The exam fee is $100, paid to Prometric. Test centers may add their own administration fee. Eligible U.S. military service members can usually test for free through DANTES.
How many college credits is DSST Fundamentals of Cybersecurity worth?
ACE recommends 3 semester hours for a passing score of 400. Your college decides how many credits it awards and which course they replace. Check your college's policy.
Can I use a calculator on the DSST Fundamentals of Cybersecurity exam?
No. This exam doesn't allow a calculator.
Is there a penalty for guessing on DSST Fundamentals of Cybersecurity?
No. Your score counts only correct answers, so a wrong answer costs nothing. Never leave a question blank: rule out what you can and pick your best guess.
What topics are on the DSST Fundamentals of Cybersecurity exam?
8 content areas, from the official outline: Vulnerability Management (17%); Network Security (16%); Application & Systems Security (15%); Authentication, Authorization, & Access Controls (12%); Compliance & Governance (12%); Disaster Recovery & Business Continuity (12%); Operational Security (10%); Physical & Environmental Security (6%).
Which DSST Fundamentals of Cybersecurity topics should I study first?
Start with the three heaviest: Vulnerability Management (17%), Network Security (16%) and Application & Systems Security (15%). Together they are about 48% of the exam, roughly 48 of 100 questions. The guide's chapters run in that order, heaviest first.
Is the DSST Fundamentals of Cybersecurity exam hard?
It depends on what you already know. No single area dominates: the largest, Vulnerability Management, is 17% and the smallest, Physical & Environmental Security, is 6%, so broad coverage matters more than deep expertise in one topic. Take the free diagnostic above to see where you stand in about 10 minutes.
What kinds of questions are on the DSST Fundamentals of Cybersecurity exam?
The guide sorts them into 5 types: “Direct definition”, “Scenario to concept”, “Right tool or technology for the job”, “Closest-term discrimination” and “Process or calculation”. Every question has 4 answer choices. Try the 10 free questions above to see the style.
How long should I study for DSST Fundamentals of Cybersecurity?
Use the diagnostic to decide. If you already know most areas, two weeks of daily review is often enough; if the subject is new to you, plan on eight. The full guide has 2-, 4- and 8-week plans built from the exam weights.
How should I pace myself on the DSST Fundamentals of Cybersecurity exam?
On average you have about 72 seconds per question (120 minutes for 100 questions). Be past question 33 a third of the way through and past question 67 two-thirds through. If a question takes more than a minute, pick your best guess, mark it and come back.
What happens if I don't pass DSST Fundamentals of Cybersecurity?
You can retake a DSST exam after 30 days. Use the wait to work through the areas the score report and the diagnostic show you missed.
Do colleges accept DSST Fundamentals of Cybersecurity for credit?
DSST exams are accepted at more than 1,500 colleges and universities, but each school decides which exams it accepts, the score it requires and the credit it gives. Look up your college's DSST policy before you book.
How is the guide different from the DSST Fundamentals of Cybersecurity course?
The guide is a 38-page PDF for review and self-testing. The DSST Fundamentals of Cybersecurity course is a full online course with lessons, quizzes and a practice exam, for $19 with lifetime access. Many students use the guide first, then take the course for the areas the diagnostic flags.
How up to date is this DSST Fundamentals of Cybersecurity guide?
Last updated 2026. The exam details were checked against Prometric's published exam information in 2026. Exams change, so confirm the details on the official exam page before you register.
What should I do the night before the exam?
Read the cram sheet once, slowly. Check your test time, the location or remote-proctoring setup, and the ID you need. Then sleep: a rested brain recalls more than a crammed one. In the morning, skim the memory tricks and common traps, then stop studying.
What textbooks does DSST recommend for Fundamentals of Cybersecurity?
The DSST fact sheet lists the Official (ISC)2 Guide to the CISSP CBK, Pfleeger's Security in Computing and Conklin and White's CompTIA Security+ All-in-One Exam Guide. DSST suggests checking any textbook against the content outline and studying from more than one.
What is the CIA triad on DSST Fundamentals of Cybersecurity?
The security triad is confidentiality, integrity and availability. It's the first topic under Application and Systems Security (15%), and you should be able to say which of the three a given control protects.
Does DSST Fundamentals of Cybersecurity include cryptography?
Yes. Fundamentals of cryptography are part of Application and Systems Security (15%). DSST's official sample questions ask which keys are used for digital signatures (asymmetric) and which standard certificate authorities use for certificates (X.509).
Is DSST Fundamentals of Cybersecurity like CompTIA Security+?
The topics overlap — threats, network security, access control, cryptography, risk and continuity — but the DSST is a college-credit exam at an introductory level, not a professional certification.
Is there a CLEP cybersecurity exam?
No. CLEP does not offer a cybersecurity exam, so DSST Fundamentals of Cybersecurity is the credit-by-exam option for this subject.
Can I take DSST Fundamentals of Cybersecurity online?
Yes. DSST exams can be taken at a test center or online with a remote Prometric proctor.
Choose how you want to study
Start with the guide, or get everything for DSST in one plan.
$19one-time · lifetime
- Lessons for every content area
- Quizzes and a practice final exam
- Lifetime access, study at your pace
$29/month
- Every DSST study guide
- Prep courses for all DSST subjects
- Cancel anytime
DSST® is a registered trademark of Prometric, which was not involved in producing this guide and does not endorse it. TransferCredit.org is independent and not affiliated with Prometric. © 2026 UPI Globale Edu Inc.