Objective 5.1 Identify Common Threats Used to Compromise Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company deploys IoT sensors in a warehouse that track employee location via Wi-Fi triangulation. The location data is sent to a cloud server over the internet using a proprietary protocol that is not encrypted. An attacker on the same Wi-Fi network is able to capture the traffic and decode the location data. The company wants to prevent this while maintaining real-time tracking. Which solution is most effective?

   • AStore the location data locally on the sensors and upload it manually.
   • BIncrease the transmit power of the sensors to improve signal strength.
   • CImplement a VPN tunnel from the sensors to the cloud server, encrypting all traffic.
   • DUse a different Wi-Fi channel for the sensors.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A smart home hub sends sensor data to the cloud using HTTP without TLS. What privacy threat does this configuration create?

   • AUnsecured data in transit
   • BLack of data anonymization
   • CUnauthorized access to personal information
   • DUnsecured data at rest
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A smart TV manufacturer collects viewing history, including specific shows and timestamps, to provide personalized recommendations. The data is stored on the TV and also sent to the manufacturer's cloud. A privacy audit reveals that the TV collects microphone audio even when the user has not enabled voice commands. The manufacturer wants to reduce privacy risk while still offering personalized recommendations. Which action is most appropriate?

   • AAnonymize the viewing history by removing the user's name, but keep the audio recordings.
   • BStore the data on the TV only and do not send it to the cloud.
   • CDisable microphone collection when voice commands are not in use, and limit viewing history collection to only what is needed for recommendations.
   • DEncrypt the viewing history and audio data both at rest and in transit.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A healthcare provider uses Bluetooth Low Energy (BLE) medical devices that transmit patient data to a gateway. The BLE link uses a fixed PIN that is the same for all devices. A security analyst discovers that the PIN is easily guessable and that the data is not encrypted at the application layer. The provider must balance patient safety (devices must remain operational) with privacy. Which remediation best addresses the privacy threat while minimizing disruption?

   • AReplace the fixed PIN with a unique, strong PIN per device and enable application-layer encryption on the BLE link.
   • BDisable BLE and require patients to connect via a wired connection.
   • CIncrease the transmit power of the BLE devices to improve signal strength.
   • DImplement a network-level firewall to block unauthorized access to the gateway.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital deploys wearable patient monitors that transmit vital signs to a central server over the facility's Wi-Fi network. A security review reveals the monitors use an unencrypted protocol and the network uses open authentication. What is the most immediate privacy threat to the patient data?

   • AThe wearable devices may collect more data than necessary.
   • BAn attacker on the same network can intercept the vital-sign transmissions.
   • CThe hospital's server may store the data without encryption at rest.
   • DThe hospital lacks a data retention policy for the vital signs.
   Reveal Solution Discussion Select an answer first