A unit in a building can be targeted by any enemy that can see the building itself. In other words, if an enemy can see the building, it can see the unit inside it. For ordinary shooting, missile fire is worked out as normal - the unit inside counts as being skirmishers in hard cover, for a massive -3 to hit (skirmishers don't get their normal -1 modifier on top of this). Remember that the unit has no ranks as such and so attacks that can affect multiple ranks, such as bolt throwers, will only hit one model.
Against cannons, stone throwers and other attacks that do not roll to hit or that use templates, if any part of the building is touched or crossed by the attack, the unit will take D6 hits. If such an attack inflicts hits at different Strength values, like a stone thrower, then all hits are worked out at the lower Strength.