Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   What is the best practice to prevent security misconfigurations?

   • AUsing default settings provided by the vendor
   • BUsing secure configuration baselines and regularly auditing settings
   • CDisabling all security features to improve performance
   • DAllowing all ports to be open for flexibility
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is an effective defense against session replay attacks?

   • AStoring session tokens in URLs
   • BDisabling session expiration
   • CUsing the same session token for the entire user session
   • DUsing TLS to encrypt session tokens in transit
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   A web application has a redirect parameter that accepts any URL. An attacker crafts a link that redirects users from the legitimate site to a malicious phishing page. What vulnerability is being exploited?

   • ACross-site scripting (XSS)
   • BSession fixation
   • CSQL injection
   • DUnvalidated redirects and forwards
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A developer for a smart-home portal builds a device search feature that concatenates user input directly into a SQL query. A security review finds that a user can submit `' OR 1=1--` in the search box and retrieve all device records. Which remediation is the most effective and sustainable fix?

   • AEscape single quotes in the user input before concatenating it into the query.
   • BAdd a Web Application Firewall (WAF) rule to block requests containing `OR 1=1`.
   • CUse parameterized queries so user input is treated as data, not executable SQL.
   • DRestrict the search feature to authenticated administrators only.
   Reveal Solution Discussion Select an answer first