Asset Identification CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why are asset dependencies important in security testing?

   • AThey automatically apply security patches to dependent assets
   • BThey help identify which assets are critical to the operation of others
   • CThey eliminate the need for testing individual assets
   • DThey determine the physical location of assets
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a typical component of an asset inventory entry?

   • AThe asset's current market value in real time
   • BThe asset's patch history
   • CThe asset's vulnerability scan results
   • DThe asset's unique identifier and description
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is helping a manufacturing company classify its assets for a risk-based security test. The company has a production control system (PCS) that directly manages the assembly line, a sales CRM with customer contact data, and a public marketing website. The PCS is air-gapped from the corporate network. According to standard asset classification principles, which asset should be classified with the HIGHEST criticality?

   • AThe sales CRM, because it contains sensitive personal data subject to privacy regulations.
   • BThe production control system, because its compromise could halt production and cause significant financial and safety impacts.
   • CThe public marketing website, because it is exposed to the internet and has the largest attack surface.
   • DAll three should be classified as equally critical, since any compromise is unacceptable to the business.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security tester is planning a test for a company that uses a legacy single sign-on (SSO) system. The SSO system is a dependency for the company's email, CRM, and file storage services. The SSO system is at the end of its lifecycle and is no longer patched. The tester has a limited budget and must choose between testing the SSO system or testing the email system. Which choice is more justified?

   • ATest neither system, as the SSO is legacy and the email system is well-protected by other controls.
   • BTest both systems equally, splitting the budget between them.
   • CTest the email system, as it contains sensitive communications and is a primary target for attackers.
   • DTest the SSO system, as it is a shared dependency and its compromise would affect multiple critical assets.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an intangible asset in the context of security testing?

   • AA network firewall appliance
   • BA database server
   • CThe organization's brand reputation
   • DAn employee laptop
   Reveal Solution Discussion Select an answer first