Objective 5.1 Identify Common Threats Used to Compromise Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A medical device manufacturer stores patient health data on the device's internal storage. The data is not encrypted, and the device is designed to be returned for servicing. A security review finds that the data can be extracted from the device's storage. The manufacturer wants to protect patient privacy while allowing the device to be serviced. Which action is most appropriate?

   • AAnonymize the data on the device by removing patient names.
   • BKeep the device on-site and have a technician service it without returning it.
   • CRemove the storage from the device before sending it for servicing.
   • DEncrypt the internal storage and implement a secure wipe procedure before the device is returned for servicing.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A research institute publishes a dataset from smart home sensors that includes energy usage patterns and occupancy schedules. They remove names and addresses, but each record includes the home's square footage, number of occupants, and daily energy consumption. A researcher is able to identify specific homes by correlating the data with public property records. The institute wants to release the data for research while minimizing re-identification risk. Which approach is most appropriate?

   • ARemove the square footage and occupant count fields entirely, leaving only energy consumption.
   • BApply k-anonymity to the dataset, generalizing square footage and occupant counts to ensure each combination appears at least k times.
   • CPublish the data only to approved researchers under a data use agreement.
   • DAdd random noise to the energy consumption values.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A smart-building vendor deploys occupancy sensors in each office to control HVAC. The sensors also capture audio snippets to detect unusual noises, and the vendor stores these recordings indefinitely to improve their AI models. The building manager is concerned about privacy. Which action best reduces the privacy risk while preserving the core function?

   • AAnonymize the audio recordings by removing employee names from the metadata before storage.
   • BIncrease the sensitivity of the audio sensors to capture more detail for better noise detection.
   • CKeep audio capture for AI improvements but encrypt the recordings at rest and in transit.
   • DDisable audio capture and configure the sensors to store only occupancy counts, with a 30-day retention period.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A company that makes smart thermostats keeps customer temperature logs for 10 years, even though the service only needs them for 1 year. What privacy threat does this represent?

   • AUnauthorized access to personal information
   • BUnsecured data in transit
   • CLack of data retention policies
   • DLack of data anonymization
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A wearable health monitor transmits patient data to a clinic server over a Wi-Fi network without any encryption. What is the primary privacy risk?

   • AData being permanently deleted from the server
   • BData being anonymized automatically
   • CData being corrupted due to storage failure
   • DData being intercepted and read by an attacker
   Reveal Solution Discussion Select an answer first