Assuming they have any strategy at all, I doubt ships. The 9/11 attack was against symbolic targets e.g. WTC, Pentagon. If they are still on the symbolic America tack, maybe Wall Street, Banks or the Service Academies, so these should be watched.
Another tack could be attacks on our economy e.g. Shopping Malls, communications, or energy, these are pretty vulnerable.
More remote, I would put people attacks, either against population centers or political assassinations.
In short, unless we can end the breeding of terrorists we need people capable of target triage analysis, big time.
I think taking out the QE2 could be considered a symbolic hit, and it would put a serious dent in the cruise ship industry.
Also, considering that AQ likes multiple attacks, an attack on a cruise ship wouldn't exclude other attacks on other targets.
Political asssassination attempts are alrady occurring: Musharraf.