A telematics portal exposes vehicle location data via URLs like `/api/vehicle/1234/location`. A security tester discovers that changing the numeric ID in the URL returns another customer's vehicle data without any authorization check. Which control should be implemented to close this vulnerability?

Add an authorization check that verifies the authenticated user owns or has permission for the requested vehicle ID.

Encrypt the vehicle ID in the URL so it cannot be guessed.

Obfuscate the vehicle ID by using a random UUID instead of a sequential integer.

Require the user to re-authenticate before every API call.

A web application uses URLs like /profile?id=123 to display user profiles. An attacker changes the id to 124 and views another user's profile without authorization. What vulnerability is being exploited?

Unsecure direct object reference (IDOR)

An attacker crafts a malicious website that, when visited by an authenticated user, submits a request to change the user's email address on a vulnerable web application. What type of attack is this?

Cross-site request forgery (CSRF)

A smart-lighting vendor's mobile app authenticates users against a cloud API. A security review finds that the API has no account lockout or rate limiting, allowing an attacker to brute-force passwords. Which control is the most appropriate to implement?

Implement rate limiting on the authentication endpoint, such as a maximum of 5 attempts per minute per account and per IP.

Add a CAPTCHA to the login form.

Use a longer password minimum length.

Require users to change their passwords every 30 days.

A smart-home portal's session management uses a fixed session ID that is regenerated only at login. A security analyst discovers that an attacker can force a victim's browser to use a known session ID (session fixation) and then wait for the victim to authenticate. Which defense is most effective against this specific attack?

Set the session cookie to `SameSite=Strict`.

Regenerate the session ID immediately after successful authentication.

Bind the session to the user's user-agent string.

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 1Objective 1

Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 7)

Part of the 1.0 Securing IoT Portals domain, which accounts for 29% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

49questions here

10free pages

16concepts

29%of the exam

16 Concepts in This Objective

Account Enumeration
Weak Default Credentials
Injection Flaws
Unsecure Direct Object References
Sensitive Data Exposure
Cross-Site Request Forgery (CSRF)
Unvalidated Redirects and Forwards
Session Management
Malformed URLs
Session Replay
Reverse Shell
Misconfiguration
Weak Account Lockout Settings
No Account Lockout
Unsecured Credentials
Lack of Integration Credentials on Edge Devices

Questions 31–35

31application · medium
A telematics portal exposes vehicle location data via URLs like `/api/vehicle/1234/location`. A security tester discovers that changing the numeric ID in the URL returns another customer's vehicle data without any authorization check. Which control should be implemented to close this vulnerability?
Select an answer first
32foundation · easy
A web application uses URLs like /profile?id=123 to display user profiles. An attacker changes the id to 124 and views another user's profile without authorization. What vulnerability is being exploited?
Select an answer first
33foundation · easy
An attacker crafts a malicious website that, when visited by an authenticated user, submits a request to change the user's email address on a vulnerable web application. What type of attack is this?
Select an answer first
34application · medium
A smart-lighting vendor's mobile app authenticates users against a cloud API. A security review finds that the API has no account lockout or rate limiting, allowing an attacker to brute-force passwords. Which control is the most appropriate to implement?
Select an answer first
35expert · hard
A smart-home portal's session management uses a fixed session ID that is regenerated only at login. A security analyst discovers that an attacker can force a victim's browser to use a known session ID (session fixation) and then wait for the victim to authenticate. Which defense is most effective against this specific attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.