6.2 Understand Target Systems (asset Inventory and Who Would Target Those Assets) CCFH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard · select all that apply

   A financial institution is building an asset inventory to prioritize hunting. They have identified the following assets: a core banking system, a customer relationship management (CRM) tool, a development environment, and a public-facing mobile app backend. Which of the following assets should be considered high-value targets for a cybercriminal seeking financial gain? (Select all that apply.)

   • AThe development environment, because it may contain source code and credentials that could be used to access production systems.
   • BThe public mobile app backend, because it is internet-facing and could be exploited to access user accounts.
   • CThe CRM tool, because it contains customer PII and interaction history that can be used for targeted phishing or social engineering.
   • DThe core banking system, because it holds the most sensitive financial records and transaction data.
   Check answers Discussion Select an answer first
2. 12foundation · easy

   When prioritizing hunting efforts, why is it important to classify assets by their business value and criticality?

   • ATo ensure that all assets receive the same level of monitoring and protection
   • BTo identify which assets are most likely to be attacked by external actors
   • CTo focus hunting resources on assets whose compromise would cause the greatest business impact
   • DTo reduce the total number of assets that need to be inventoried
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A gaming company's user database is defaced, and a message is left criticizing the company's monetization policies. No sensitive user data appears to have been exfiltrated. Which threat actor profile is most consistent with this incident?

   • AA cybercriminal gang testing the company's security for a future ransomware attack.
   • BA disgruntled employee with access to the database.
   • CA nation-state actor seeking to disrupt the company's operations.
   • DA hacktivist group protesting the company's business practices.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A university research lab stores proprietary algorithms for a new drug discovery process. The lab's security team is creating hunting hypotheses. Which combination of threat actor and target is most likely and should be prioritized?

   • AA hacktivist group targeting the algorithms to protest animal testing.
   • BA nation-state actor targeting the algorithms for economic espionage.
   • CA cybercriminal gang targeting the algorithms for direct financial gain through resale.
   • DAn insider threat targeting the algorithms for personal academic recognition.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software development company's source code repository is exfiltrated. The stolen code includes proprietary algorithms for a new product. The company suspects the attack was highly targeted and sophisticated. Which threat actor profile is most likely?

   • AA nation-state actor seeking to steal intellectual property for economic or military advantage.
   • BA cybercriminal gang seeking to sell the source code on the dark web.
   • CA hacktivist group seeking to expose the company's business practices.
   • DA disgruntled employee who wanted to harm the company.
   Reveal Solution Discussion Select an answer first