Objective 1.1 Identify Common Threats Used to Compromise Unsecure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A smart-hub vendor's cloud portal was launched with debug mode enabled, which displays detailed stack traces and database queries to end users. An attacker uses this information to craft a targeted SQL injection. Which remediation is most appropriate?

   • ARestrict access to the portal to a specific IP range.
   • BAdd a WAF rule to block requests that contain SQL keywords.
   • CEncrypt the database connection string in the configuration file.
   • DDisable debug mode in production and configure generic error pages that do not reveal internal details.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A web application sets a session cookie without the Secure attribute. What is the primary risk of this misconfiguration?

   • AThe session cookie will be vulnerable to SQL injection
   • BThe session cookie will be stored insecurely on the server
   • CThe session cookie can be transmitted over unencrypted HTTP, allowing interception
   • DThe session cookie will expire immediately
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturer ships a fleet of industrial sensors with a hardcoded admin password that is identical across all units. A customer's sensor was compromised and used to pivot into the corporate network. Which combination of changes should the manufacturer implement to prevent this class of incident across the fleet?

   • ADisable remote administration and require physical console access for all configuration changes.
   • BForce a unique credential per device at first boot and require a secure channel for the device-to-cloud integration key exchange.
   • CKeep the shared password but encrypt the configuration file that stores it.
   • DDocument the default password in the quick-start guide and advise customers to change it after installation.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is an effective prevention measure against reverse shell attacks?

   • AImplementing egress filtering to restrict outbound connections
   • BUsing HTTP instead of HTTPS
   • CDisabling the web server's firewall
   • DAllowing all outbound traffic to any destination
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A smart-building vendor's tenant portal returns 'Invalid username or password' for unknown usernames but 'Invalid password' for known ones. An attacker has been observed making repeated login attempts. Which remediation should the security team implement to address the information disclosure while still allowing legitimate users to recover access?

   • AChange the error message to 'Invalid credentials' and implement a strict account lockout after a single failed attempt.
   • BDisable the login form entirely and require all users to authenticate via a hardware token.
   • CKeep the distinct error messages for usability, but add a CAPTCHA after three failed attempts.
   • DReturn a generic error message for both invalid username and invalid password, and implement progressive rate limiting after several failed attempts.
   Reveal Solution Discussion Select an answer first