Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is the most effective defense against SQL injection attacks?

   • ADisabling JavaScript in the browser
   • BUsing parameterized queries (prepared statements)
   • CEncoding all user input with base64
   • DUsing HTTPS for all communications
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A smart-watch vendor's companion app stores the user's cloud API key in a local configuration file in plaintext. A security review also finds that the app sends the API key in the URL query string. Which remediation should the vendor implement?

   • AStore the API key in the platform's secure keystore and send it in the request header over TLS.
   • BRequire the user to re-enter the API key on every app launch.
   • CObfuscate the API key by base64-encoding it in the config file and the URL.
   • DUse a shorter API key to reduce the impact if exposed.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A building-automation portal issues session cookies without the `Secure` or `SameSite` attributes and does not expire sessions. An attacker on the same Wi-Fi network captures a session cookie and uses it to access the portal as the victim. Which combination of changes would most directly prevent this attack?

   • ARegenerate the session ID on every page load.
   • BSet the `Secure` and `SameSite=Strict` attributes on the session cookie and enforce an idle session timeout.
   • CSet the `HttpOnly` attribute on the session cookie and use a longer session key.
   • DStore the session ID in a URL parameter instead of a cookie.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A smart-city traffic portal uses a URL parser to determine which page to serve. A security researcher submits a URL containing encoded characters and path traversal sequences like `%2e%2e%2f` and observes that the portal serves files from outside the intended web root. Which fix is most appropriate?

   • ADisable directory listing on the web server.
   • BNormalize and validate the URL path against an allow-list of permitted routes before processing the request.
   • CIncrease the web server's logging verbosity to capture all requests.
   • DBlock requests containing `%2e` or `..` in the URL.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the best practice for managing credentials on edge devices for cloud integration?

   • AStoring credentials in plaintext configuration files
   • BUsing the same strong password for all devices
   • CUsing unique credentials per device and storing them in a secure hardware element
   • DHardcoding credentials in the firmware
   Reveal Solution Discussion Select an answer first