AP Cybersecurity Drill 9: Clinic Network with Exposed Services

Question 1. Reading the scan, which service most directly exposes patient health records to the internet?

• A) The clinic's normal public website, which the scan shows is reachable over HTTPS on port 443
• B) The records database on port 3306, internet-reachable with default admin credentials still enabled ✓
• C) The clinic's networked office printer, which the scan shows is reachable from the internet on 9100
• D) None of the listed services in the scan actually exposes any patient data to outsiders on the internet

Explanation: Choice B is correct. The records database is reachable directly from the internet and still has its default admin account and password enabled, which is the most direct exposure of patient data. Choice A is incorrect. A normal HTTPS website on port 443 is expected and does not itself expose the records. Choice C is incorrect. The printer is an exposure, but it does not directly hold or serve patient records. Choice D is incorrect. The database exposure is real and serious, so it is not true that nothing exposes patient data.

Question 2. Which single detail in the scan would most likely let an attacker log in to the database without guessing a unique password?

• A) The clinic's public website is being served out over network port 443, just as one would expect
• B) The clinic's shared office printer is sitting and listening for incoming print jobs on port 9100
• C) The patient records database simply happens to be running on the standard database port of 3306
• D) The records database still has its default admin account and password enabled and reachable ✓

Explanation: Choice D is correct. Default admin credentials are publicly known, so an attacker who reaches the database can log in with them without having to guess a unique password. Choice A is incorrect. Serving the website on 443 is normal and is not a credential weakness. Choice B is incorrect. The printer's port does not provide a database login. Choice C is incorrect. Using the standard database port is common and does not by itself grant access; the default credentials do.

Question 3. Why does the remote-desktop service raise the risk even though the database is the obvious target?

• A) Remote desktop on the front-desk PC will automatically encrypt the records database whenever it connects
• B) Remote desktop access to the front-desk PC only ever works from inside the clinic's own building walls
• C) The password-only front-desk PC can itself open the database, giving an attacker an indirect path in ✓
• D) Remote desktop is only a screen-display protocol, so attackers are not able to make any use of it at all

Explanation: Choice C is correct. The front-desk PC is reachable by password-only remote desktop and is allowed to open the records database, so compromising that PC gives an attacker an indirect route to the data. Choice A is incorrect. Remote desktop does not encrypt the database; it is a remote-access service, not a data-protection one. Choice B is incorrect. The service is internet-reachable in the scan, so it is not limited to inside the building. Choice D is incorrect. Remote desktop is a common attack target, not something attackers cannot use.

Question 4. On this flat, unsegmented network, why is the internet-reachable printer a meaningful risk and not just a harmless device?

• A) A compromised internet-reachable printer can become a foothold on the flat network toward the database ✓
• B) Networked office printers by default keep stored full copies of every patient health record on their disks
• C) The office printer's port 9100 is in fact the exact same port that the records database uses to listen on
• D) Printers are simple appliances, so they cannot really be attacked or compromised in any meaningful way

Explanation: Choice A is correct. If an attacker compromises the internet-reachable printer, it becomes a foothold on the same flat network as the records database, from which the attacker can try to reach more sensitive systems. Choice B is incorrect. Printers do not store full patient records by default; the risk is the foothold, not stored data. Choice C is incorrect. The printer uses port 9100 and the database uses 3306, so they are not the same port. Choice D is incorrect. Networked printers can be compromised, so they are not harmless.

Question 5. Which initial remediation plan would most reduce the clinic's exposure while preserving legitimate access?

• A) Replace the clinic's current office printer with a newer networked model made by a different vendor
• B) Install antivirus software on the front-desk PC while still leaving the records database fully reachable from the internet
• C) Ask all of the clinic's staff to begin choosing noticeably longer passwords for their work email accounts
• D) Stop exposing the database and remote desktop, disable default credentials, and segment the records database ✓

Explanation: Choice D is correct. Removing the database and remote desktop from direct internet reach, disabling the default credentials, and restricting the database to a segment only authorized clinic systems can reach together cut the direct and indirect paths to patient data while preserving legitimate access. Choice A is incorrect. A newer printer does not address the exposed database, the default credentials, or the flat network. Choice B is incorrect. Antivirus on one PC leaves the internet-reachable database and its default credentials wide open. Choice C is incorrect. Longer email passwords do nothing about an internet-reachable database with default admin credentials.