Asset Identification CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security tester is planning a test for a hospital's patient portal. The portal depends on a backend database and an authentication service. The authentication service is shared with the hospital's internal staff system. The tester has limited time and must prioritize testing. Which asset should be tested FIRST to maximize the impact of the assessment?

   • AThe network infrastructure connecting the portal, database, and authentication service.
   • BThe backend database, as it contains the most sensitive patient data.
   • CThe patient portal web application, as it is the primary user-facing asset.
   • DThe authentication service, as it is a dependency for both the patient portal and the internal staff system.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security tester is reviewing the asset inventory of a multinational corporation. The inventory is stored in a spreadsheet and contains inconsistent data. For example, some assets are listed by IP address, others by hostname, and some by application name. There are also duplicate entries. The tester needs to use this inventory to plan a security test. What is the MOST effective way to handle this documentation issue?

   • AAsk the IT team to fix the inventory before the test can begin.
   • BCreate a new, standardized inventory by consolidating the data, removing duplicates, and using a consistent naming convention.
   • CUse the inventory as-is, as it is the only source of truth available.
   • DIgnore the inventory and rely on network scanning to discover assets.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of an asset inventory in security testing?

   • ATo replace the need for risk assessments
   • BTo provide a complete and up-to-date list of assets that need protection
   • CTo automatically patch all identified vulnerabilities
   • DTo assign ownership of all assets to the security team
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester is performing a risk assessment for a logistics company. The company's primary asset is its package-tracking database, which is critical for daily operations. The database is hosted on a physical server in a local data center. The tester is asked to assess the value of this asset. Which of the following factors should be included in the asset value assessment?

   • AThe salary of the database administrators who manage the system.
   • BThe amount of money the company spends on cybersecurity insurance premiums for the database.
   • CThe cost to recreate the data, the revenue lost per hour of downtime, and the reputational damage from a data breach.
   • DOnly the cost of the physical server hardware and the database software licenses.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security tester is starting an assessment for a university. The university has a mix of on-premises servers, cloud-based student information systems, and IoT devices on the campus network. The tester needs to identify all assets. Which approach BEST ensures a complete asset identification?

   • AInterview the IT staff, network administrators, and department heads to gather information about all known systems and services.
   • BCombine automated discovery tools with interviews and a review of existing documentation, then verify the results.
   • CUse a network scanning tool to discover all devices connected to the campus network.
   • DReview the university's procurement records to identify all purchased hardware and software.
   Reveal Solution Discussion Select an answer first