Objective 5.1 Identify Common Threats Used to Compromise Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A smart building's access control system stores employee badge swipe logs on a local server. The logs include employee names, badge IDs, and timestamps. The server is not encrypted at rest, and logs are kept for 5 years, although the company's policy requires deletion after 1 year. The building manager wants to reduce privacy risk without losing the ability to investigate security incidents. Which approach is most effective?

   • AAnonymize the logs by removing employee names, but keep the timestamps and badge IDs.
   • BMove the logs to a cloud storage service with encryption enabled, but keep the same 5-year retention.
   • CEncrypt the server's storage and implement an automated deletion job that purges logs older than 1 year, with a separate archive for active investigations.
   • DKeep the logs for 5 years but restrict access to the server to only the building manager.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A smart thermostat manufacturer collects the user's home address, daily schedule, and preferred temperature settings to provide weather-based adjustments. Which practice does this represent?

   • AData anonymization
   • BCollection of unnecessary personal information
   • CData minimization
   • DData retention policy
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A smart meter stores historical energy usage data on a local database without any encryption. What is the main privacy risk?

   • AData is vulnerable to interception during transmission
   • BThe data is automatically deleted after a short period
   • CAn attacker who gains physical access can read the data directly
   • DThe data is anonymized by the database system
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A smart city's traffic management system collects vehicle location data from GPS sensors in public transit vehicles. The data is stored in a central database and is used for route optimization. The city has no retention policy, so the data is kept indefinitely. A freedom of information request could expose the location history of specific vehicles. The city wants to reduce privacy risk while maintaining the ability to analyze traffic patterns. Which approach is most effective?

   • AKeep the raw data indefinitely but restrict access to authorized personnel only.
   • BMove the data to a separate server that is not subject to freedom of information requests.
   • CAnonymize the raw data by removing vehicle identifiers, but keep the timestamps and routes.
   • DImplement a retention policy that deletes raw location data after 30 days, but keep aggregated traffic statistics indefinitely.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A smart grid uses IoT sensors to report energy consumption data to a central system. The data is transmitted over a cellular network using a protocol that does not support encryption. A security consultant recommends upgrading the sensors to support a newer protocol with encryption, but this would require replacing all sensors, which is costly and time-consuming. The utility company must balance cost and privacy. Which approach is most practical?

   • AAccept the risk because the data is not highly sensitive.
   • BReplace all sensors with newer models that support encryption.
   • CUse a different cellular provider that offers encryption.
   • DImplement a gateway that receives the unencrypted data from sensors and encrypts it before sending it over the cellular network.
   Reveal Solution Discussion Select an answer first