Assets and Their Corresponding Protection Level CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is valuing two assets: a customer relationship management (CRM) database and a proprietary algorithm. The CRM database is critical for daily sales operations, while the algorithm is a potential future revenue source but not yet monetized. Which valuation approach is most appropriate?

   • AValue the algorithm higher because it is harder to replace.
   • BValue the CRM database higher because its loss would immediately disrupt revenue, while the algorithm's future value is uncertain.
   • CValue both equally because they are both important to the company's success.
   • DValue the algorithm higher because it represents future potential revenue.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has classified its internal communications as 'medium protection' and its public API documentation as 'low protection'. Which control mapping is most appropriate?

   • AInternal communications require multi-factor authentication; public API documentation requires password protection.
   • BBoth require the same level of encryption and access control.
   • CInternal communications require no controls because they are internal; public API documentation requires encryption.
   • DInternal communications require access control and encryption; public API documentation requires no special controls.
   Reveal Solution Discussion Select an answer first
4. 18application · medium · select all that apply

   A security tester is identifying assets for a new project. Which of the following are correctly categorized as assets? (Select all that apply.)

   • AThe project's source code repository (software).
   • BThe office coffee machine (hardware).
   • CThe company's brand reputation (intangible).
   • DThe project manager (personnel).
   • EThe project's requirements document (data).
   Check answers Discussion Select an answer first
5. 19application · easy

   A security tester is identifying assets for a new cloud-based application. Which item is correctly categorized as a data asset?

   • AThe cloud administrator responsible for the application.
   • BThe application's user database containing personal information.
   • CThe application's authentication module.
   • DThe virtual machine running the application.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team must protect a research database (high value, low exposure) and a customer support portal (medium value, high exposure). The budget is sufficient for only one major security initiative. Which initiative should be prioritized?

   • AThe customer support portal, because its high exposure makes it more likely to be attacked.
   • BNeither, because the budget is insufficient to make a meaningful impact.
   • CBoth equally, splitting the budget between the two initiatives.
   • DThe research database, because it has higher value.
   Reveal Solution Discussion Select an answer first