Objective 4.1 Identify Common Threats Used to Exploit Unsecure Data. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An attacker exploits a vulnerability to gain higher-level permissions on an IoT device, allowing them to access sensitive data being processed by an application. Which type of threat is this?

   • APhysical theft
   • BEavesdropping
   • CPacket sniffing
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which threat involves an attacker intercepting and potentially altering communications between two IoT devices without either device knowing?

   • ADenial-of-service attack
   • BMan-in-the-middle attack
   • CPhishing attack
   • DSQL injection
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security auditor is reviewing the data protection measures for a medical device that stores patient records on a local hard drive and transmits them to a central server. The auditor finds that the hard drive is encrypted, but the transmission is not. The auditor also finds that the device is often left in unsecured areas. Which threat is the auditor most likely to recommend addressing first?

   • AMemory scraping during processing
   • BPrivilege escalation on the device
   • CPhysical theft of the hard drive
   • DEavesdropping on the transmission
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hospital uses a legacy medical device that transmits patient vitals to a central monitoring station over an unencrypted wireless protocol. An attacker in the parking lot uses a directional antenna to capture these transmissions and later replays them to trigger false alarms. Which threat is the attacker primarily exploiting?

   • AMemory scraping of data in use
   • BPhysical theft of storage media
   • CEavesdropping on data in motion
   • DUnauthorized access to data at rest
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A utility company needs to upgrade its smart meter network. The meters transmit usage data to a central collector over a wireless protocol. The company is considering two options: (1) using a protocol with strong encryption but no authentication, or (2) using a protocol with strong authentication but no encryption. The company's main concern is preventing attackers from injecting false usage data to reduce customers' bills. Which option should the company choose, and why?

   • AOption 2, because authentication prevents unauthorized injection of data
   • BOption 2, because encryption is not needed for this type of data
   • COption 1, because encryption prevents attackers from reading the data
   • DOption 1, because encryption is more important than authentication for data integrity
   Reveal Solution Discussion Select an answer first