Asset Identification CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester is reviewing the asset inventory of a software company. The inventory includes a legacy customer portal that is still in use but has been officially 'sunset' by the product team. The portal is no longer being patched, but the company continues to sell subscriptions that rely on it. The tester is planning the scope of a security test. How should the tester treat this asset?

   • AReclassify the portal as a 'non-asset' since it is no longer in active development.
   • BExclude the portal from the test scope, as it is in the 'sunset' lifecycle stage and no longer supported.
   • CInclude the portal in the test scope and flag it as a high-risk asset due to its unsupported and unpatched status.
   • DInclude the portal only if the product team confirms they will provide support during the test.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key step in the asset identification process?

   • ACalculating the annual loss expectancy for each asset
   • BDefining the scope of the organization's assets to be identified
   • CConducting penetration tests on all identified assets
   • DImplementing security controls for each asset
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key characteristic of good asset documentation?

   • AConsistency in format and terminology
   • BFrequent changes without version control
   • CRestricted access to only senior management
   • DMinimal detail to save time
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security tester is assessing the value of a customer database for a retail company. The database is used for marketing campaigns and contains purchase history. The company is considering a security test. The tester needs to justify the cost of the test to the CFO. Which combination of factors BEST represents the true value of the database?

   • AThe potential revenue loss from a data breach, the cost of notifying customers, and the reputational damage.
   • BThe number of records in the database multiplied by the average customer lifetime value.
   • CThe cost of the database software licenses and the hardware it runs on.
   • DThe amount of money the marketing team spends on campaigns that use the data.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security tester is scoping a penetration test for a financial services firm. The firm's CISO insists that the test cover 'all assets'. During the scoping meeting, the tester notes that the firm's customer relationship management (CRM) data, the marketing team's public website, the internal employee directory, and the office coffee machine's IoT sensor are all mentioned. Which of the following is the MOST appropriate way to define the scope of 'assets' for this security test?

   • AInclude all four items, but classify them by criticality and sensitivity to prioritize testing effort.
   • BInclude only the CRM data and the employee directory, as these are the most sensitive to the firm's operations.
   • CInclude only the CRM data, as it is the only true 'crown jewel' asset that would cause significant financial impact if compromised.
   • DExclude the IoT sensor and the public website, as they are not under the direct administrative control of the IT department.
   Reveal Solution Discussion Select an answer first