CERTNEXUSCertNexus Certified IoT Security Practitioner (CIoTSP)
The CertNexus Certified IoT Security Practitioner (CIoTSP) certification validates your ability to secure IoT network environments, analyze vulnerabilities, and determine reasonable controls against threats. It also confirms you can monitor IoT devices and respond to incidents effectively. Earning CIoTSP demonstrates a foundational skill set in secure IoT concepts, technologies, and tools, preparing you for a wide variety of IoT security roles.
395 practice questions · Updated 2026-07-30
CERTIFIED-IOT-SECURITY-PRACTITIONER Curriculum
Every domain, objective, and concept the CERTIFIED-IOT-SECURITY-PRACTITIONER exam measures.
- Account Enumeration
- Weak Default Credentials
- Injection Flaws
- Unsecure Direct Object References
- Sensitive Data Exposure
- Cross-Site Request Forgery (CSRF)
- Unvalidated Redirects and Forwards
- Session Management
- Malformed URLs
- Session Replay
- Reverse Shell
- Misconfiguration
- Weak Account Lockout Settings
- No Account Lockout
- Unsecured Credentials
- Lack of Integration Credentials on Edge Devices
- Change default passwords
- Secure password recovery mechanisms
- Web interface input validation
- Credential protection
- Robust password policies
- Account lockout policies
- Account enumeration prevention
- Two-factor authentication (2FA)
- Granular role-based access control
- Password Complexity
- Credential Protection
- Two-Factor Authentication
- Password Recovery Security
- Privilege Escalation
- Role-Based Access Control
- Database Security
- Account Lockout Policy
- Access Auditing
- Security Monitoring
- Security Logging
- Granular access control
- Password management
- Re-authentication for sensitive features
- Event logging
- IT/OT admin notification
- Security monitoring
- Vulnerable Services
- Buffer Overflow
- Open Ports via UPnP
- Exploitable UDP Services
- Denial of Service (DoS) and Distributed Denial of Service (DDoS)
- DoS via Network Device Fuzzing
- Endpoint (Address) Spoofing
- Packet Manipulation and Injection
- Networking, Protocols, and Radio Communications
- Port control
- Secure memory spaces
- DoS mitigation
- Secure network nodes
- Secure field devices
- Secure network pathways
- Threats to data in motion
- Threats to data at rest
- Threats to data in use
- Encryption fundamentals
- Encrypting data in motion
- Encrypting data at rest
- Encrypting data in use
- Key management for IoT
- Collection of unnecessary personal or sensitive information
- Unsecured data in transit
- Unsecured data at rest
- Unauthorized access to personal information
- Lack of proper data anonymization
- Lack of data retention policies
- Data minimization
- Protecting sensitive data
- Regulatory compliance
- Data user authorization
- Data retention policies
- Data disposal policies
- End-user notification policies
- Courtesy notifications
- Legally required notifications
- Poorly designed/tested software/firmware
- Unsecure updates/patches
- Firmware contains sensitive information
- Lack of OTA updates
- Constrained devices with non-existent security features
- Lack of end-to-end solution
- Software/firmware not digitally signed
- Unsecure bootloader/boot
- Unsecure key storage
- Digitally signed updates
- Remote update capability
- Secure update mechanisms
- Root of trust
- Secure enclave
- Secure bootloader and secure boot
- Measured boot
- Physical Port Access
- Storage Media Theft
- Unprotected Shell Access
- Unrestricted Physical Access
- Device Disassembly
- Protect data storage medium
- Encrypt data at rest
- Protect physical ports
- Tamper-resistant devices
- Limit physical access when possible
- Hardened security for shell access
- Limit administrative capabilities and access
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CERTIFIED-IOT-SECURITY-PRACTITIONER, so none is invented.