6.2 Understand Target Systems (asset Inventory and Who Would Target Those Assets) CCFH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A government contractor has two assets: a system with classified military designs and a system with unclassified but sensitive procurement data. The security team has detected an intrusion that appears to be from a nation-state. The attackers have accessed the procurement system but not the classified system. Which hunting hypothesis is most likely?

   • AThe attackers are targeting the procurement data to understand the contractor's supply chain and identify vulnerabilities in the classified system.
   • BThe attackers are not sophisticated enough to breach the classified system, so they are settling for the procurement data.
   • CThe attackers are using the procurement system as a staging ground to launch a ransomware attack on the classified system.
   • DThe attackers are only interested in the procurement data and have no interest in the classified system.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A threat hunter observes a nation-state actor known for intellectual property theft. Which asset type would be the most logical focus for hunting hypotheses?

   • AResearch and development (R&D) systems storing proprietary designs and patents
   • BPoint-of-sale (POS) terminals
   • CPublic-facing marketing websites
   • DEmployee personal mobile devices
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital is updating its asset inventory. They have a patient portal, an imaging system (PACS), and a building management system (BMS) that controls HVAC. The security team must prioritize hunting for a ransomware attack. Which asset is most likely to be targeted to maximize operational disruption?

   • AThe patient portal, because it is internet-facing and has high exposure.
   • BAll assets are equally likely to be targeted because ransomware spreads indiscriminately.
   • CThe imaging system (PACS), because if it is unavailable, clinicians cannot access diagnostic images, halting critical patient care.
   • DThe building management system (BMS), because it controls the physical environment.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following best represents the full scope of assets that constitute an organization's attack surface?

   • AOnly the endpoints and servers that have CrowdStrike Falcon sensors installed
   • BAll hardware, software, data, and user accounts that an organization relies on to conduct business
   • COnly the data stored in cloud environments and on-premises databases
   • DOnly servers and network devices that are directly reachable from the internet
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A media company has a video streaming platform and an internal system that stores unreleased film content. The security team has detected an intrusion that exfiltrated a large amount of data from the unreleased content system. The attackers did not target the streaming platform. Which threat actor profile is most likely?

   • AA hacktivist group seeking to leak the content to protest the company's business practices.
   • BA cybercriminal gang seeking to sell the unreleased content or hold it for ransom.
   • CA nation-state actor seeking to steal the content for propaganda purposes.
   • DA disgruntled employee seeking to leak the content to harm the company.
   Reveal Solution Discussion Select an answer first