An attacker is testing a login form and notices that entering an unknown username returns a generic 'invalid credentials' message, while entering a known username returns 'invalid password'. What is the attacker able to do with this information?

Perform a denial-of-service attack by flooding the login form

Decrypt the password hashes stored in the database

Inject SQL commands to bypass authentication

Enumerate valid usernames by observing the different error messages

Which of the following is the best practice to protect sensitive data at rest?

Encrypting the data using strong encryption algorithms

Minimizing the amount of data collected

Using a strong password for the database

What is the best defense against malformed URL attacks?

Disabling cookies in the browser

Using a firewall to block all external traffic

Validating and sanitizing all URL inputs on the server

Using HTTPS for all communications

Which of the following is an effective defense against CSRF attacks?

Validating user input on the server side

Disabling cookies in the browser

Using HTTPS for all communications

Including a unique anti-CSRF token in each form submission

A web application locks an account after 3 failed login attempts, but the lockout lasts only 1 minute. What is the primary security weakness of this policy?

The lockout threshold is too high

The short lockout duration allows attackers to continue brute-force attempts after a brief wait

The lockout does not apply to all users

The lockout will lock out legitimate users

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 1Objective 1

Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 5)

Part of the 1.0 Securing IoT Portals domain, which accounts for 29% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

49questions here

10free pages

16concepts

29%of the exam

16 Concepts in This Objective

Account Enumeration
Weak Default Credentials
Injection Flaws
Unsecure Direct Object References
Sensitive Data Exposure
Cross-Site Request Forgery (CSRF)
Unvalidated Redirects and Forwards
Session Management
Malformed URLs
Session Replay
Reverse Shell
Misconfiguration
Weak Account Lockout Settings
No Account Lockout
Unsecured Credentials
Lack of Integration Credentials on Edge Devices

Questions 21–25

21foundation · easy
An attacker is testing a login form and notices that entering an unknown username returns a generic 'invalid credentials' message, while entering a known username returns 'invalid password'. What is the attacker able to do with this information?
Select an answer first
22foundation · easy
Which of the following is the best practice to protect sensitive data at rest?
Select an answer first
23foundation · easy
What is the best defense against malformed URL attacks?
Select an answer first
24foundation · easy
Which of the following is an effective defense against CSRF attacks?
Select an answer first
25foundation · easy
A web application locks an account after 3 failed login attempts, but the lockout lasts only 1 minute. What is the primary security weakness of this policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.