Which of the following is a best practice for secure session management?

Using the same session ID for the entire user lifetime

Storing session data in client-side cookies

Disabling session expiration to improve user experience

Setting a reasonable session timeout to expire idle sessions

A smart-meter portal includes a 'return to dashboard' feature that redirects users to a URL supplied in the `next` query parameter. An attacker crafts a link that redirects a logged-in user to a phishing site that mimics the portal login. Which fix should the development team implement?

Remove the `next` parameter and always redirect to the dashboard root.

Validate the `next` parameter against an allow-list of internal URLs before performing the redirect.

Add a confirmation page that shows the destination URL before redirecting.

URL-encode the `next` parameter before using it in the redirect.

Which mitigation technique is most effective in preventing account enumeration via login error messages?

Use CAPTCHA on every login attempt

Return the same generic error message for both invalid username and invalid password

Allow unlimited login attempts to avoid locking out users

Display detailed error messages to help users remember their credentials

What is the recommended way to store user passwords securely?

Using a strong one-way hashing algorithm with a unique salt per password

Using a simple hash without a salt

Storing passwords in a plaintext file

A mobile app sends user credentials to the server using HTTP instead of HTTPS. What type of vulnerability does this expose?

Unsecure direct object reference

Cross-site request forgery (CSRF)

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 1Objective 1

Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 4)

Part of the 1.0 Securing IoT Portals domain, which accounts for 29% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

49questions here

10free pages

16concepts

29%of the exam

16 Concepts in This Objective

Account Enumeration
Weak Default Credentials
Injection Flaws
Unsecure Direct Object References
Sensitive Data Exposure
Cross-Site Request Forgery (CSRF)
Unvalidated Redirects and Forwards
Session Management
Malformed URLs
Session Replay
Reverse Shell
Misconfiguration
Weak Account Lockout Settings
No Account Lockout
Unsecured Credentials
Lack of Integration Credentials on Edge Devices

Questions 16–20

16foundation · easy
Which of the following is a best practice for secure session management?
Select an answer first
17application · medium
A smart-meter portal includes a 'return to dashboard' feature that redirects users to a URL supplied in the `next` query parameter. An attacker crafts a link that redirects a logged-in user to a phishing site that mimics the portal login. Which fix should the development team implement?
Select an answer first
18foundation · easy
Which mitigation technique is most effective in preventing account enumeration via login error messages?
Select an answer first
19foundation · easy
What is the recommended way to store user passwords securely?
Select an answer first
20foundation · easy
A mobile app sends user credentials to the server using HTTP instead of HTTPS. What type of vulnerability does this expose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.