6.2 Understand Target Systems (asset Inventory and Who Would Target Those Assets) CCFH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which threat actor category is most commonly associated with financially motivated attacks such as ransomware and credit card theft?

   • AInsiders
   • BHacktivists
   • CNation-state actors
   • DCybercriminals
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large retail chain has a customer database with payment information, a supply chain management system, and a public website. The security team has limited resources and must choose one asset to focus hunting on. The company's primary concern is financial loss from fraud. Which asset should be the top priority?

   • AThe company's internal email system, because it could be used for business email compromise (BEC).
   • BThe supply chain management system, because a compromise could disrupt operations and cause indirect financial loss.
   • CThe customer database, because it contains payment card data that can be directly used for fraudulent transactions.
   • DThe public website, because it is the most exposed and could be used to spread malware.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A mid-sized law firm is updating its asset inventory. They have identified a document management system (DMS) with client contracts, a time-tracking application, and a public-facing careers page. The firm's hunting team wants to focus on the most attractive target for a cybercriminal. Which asset should they prioritize?

   • AAll assets are equally attractive because they are all part of the firm's digital footprint.
   • BThe time-tracking application, because it contains employee data that can be used for credential stuffing.
   • CThe document management system, because it holds confidential client contracts and intellectual property that can be used for extortion or sold.
   • DThe public careers page, because it is the most exposed and could be defaced.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A defense contractor's network shows a series of low-and-slow reconnaissance activities targeting a project management server that stores unclassified but sensitive engineering timelines. The activity originates from a foreign IP range and occurs during business hours in the source country's timezone. Which threat actor profile is most consistent with these observations?

   • AA hacktivist group seeking to embarrass the company by leaking project timelines.
   • BA cybercriminal gang planning to deploy ransomware on the server.
   • CA disgruntled insider who has legitimate access to the server.
   • DA nation-state intelligence service conducting long-term espionage on the company's operations.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A hospital has a patient portal, an imaging system (PACS), and a research database. The security team must prioritize hunting for a ransomware attack that would cause the most operational disruption. Which asset should be the top priority?

   • AThe imaging system (PACS), because if it is unavailable, clinicians cannot access diagnostic images, halting patient care.
   • BThe research database, because it contains valuable genomic data that could be sold.
   • CThe patient portal, because it is internet-facing and has the highest exposure.
   • DAll assets are equally critical because a ransomware attack could affect any of them.
   Reveal Solution Discussion Select an answer first