What is the most effective way to prevent unsecure direct object reference attacks?

Implement access control checks on every object request

Use sequential numeric IDs for objects

A health-monitoring wearable syncs patient data to a cloud portal. A security assessment finds that the mobile app transmits data over HTTP and the cloud database stores patient records in plaintext. Which remediation should be prioritized to protect the data?

Tokenize the patient data before storing it in the database.

Enforce TLS for all data in transit and enable encryption at rest for the database.

Require a strong password for the mobile app and the portal.

Use a VPN on the mobile device when syncing data.

What is the purpose of an account lockout policy?

To allow unlimited login attempts

To provide a backup login method

To prevent brute-force attacks by limiting the number of login attempts

A new IoT device is deployed with the manufacturer's default username 'admin' and password '1234'. What is the primary security risk of leaving these default credentials unchanged?

Attackers can easily guess the credentials because they are publicly known

The device will automatically disable its firewall

The device will fail to connect to the cloud

The device will consume more power than necessary

What is the best way to prevent unvalidated redirect attacks?

Disable all redirects in the application

Encode the redirect URL with base64

Validate the redirect URL against an allow-list of trusted domains

Use JavaScript to perform the redirect

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 1Objective 1

Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Part of the 1.0 Securing IoT Portals domain, which accounts for 29% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

49questions here

10free pages

16concepts

29%of the exam

16 Concepts in This Objective

Account Enumeration
Weak Default Credentials
Injection Flaws
Unsecure Direct Object References
Sensitive Data Exposure
Cross-Site Request Forgery (CSRF)
Unvalidated Redirects and Forwards
Session Management
Malformed URLs
Session Replay
Reverse Shell
Misconfiguration
Weak Account Lockout Settings
No Account Lockout
Unsecured Credentials
Lack of Integration Credentials on Edge Devices

Questions 6–10

6foundation · easy
What is the most effective way to prevent unsecure direct object reference attacks?
Select an answer first
7application · medium
A health-monitoring wearable syncs patient data to a cloud portal. A security assessment finds that the mobile app transmits data over HTTP and the cloud database stores patient records in plaintext. Which remediation should be prioritized to protect the data?
Select an answer first
8foundation · easy
What is the purpose of an account lockout policy?
Select an answer first
9foundation · easy
A new IoT device is deployed with the manufacturer's default username 'admin' and password '1234'. What is the primary security risk of leaving these default credentials unchanged?
Select an answer first
10foundation · easy
What is the best way to prevent unvalidated redirect attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.