Objective 4.1 Identify Common Threats Used to Exploit Unsecure Data. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company stores sensitive customer data on a network-attached storage (NAS) device. An attacker exploits a vulnerability in the NAS firmware to gain access to the stored files. Which threat is this?

   • ASide-channel attack
   • BUnauthorized access to data at rest
   • CMan-in-the-middle attack
   • DEavesdropping
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An attacker gains physical access to a warehouse and steals a hard drive containing stored IoT sensor logs. Which type of threat does this represent?

   • APhysical theft of storage media
   • BEavesdropping
   • CSide-channel attack
   • DMan-in-the-middle attack
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator notices that an attacker has been capturing all traffic on a company's Wi-Fi network. The attacker is using the captured data to impersonate legitimate users and send fraudulent requests. Which two threats are being combined in this attack?

   • APhysical theft and unauthorized access
   • BMemory scraping and privilege escalation
   • CPacket sniffing and man-in-the-middle attack
   • DSide-channel attack and eavesdropping
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is deploying a fleet of IoT sensors that send data to a central server. The sensors use a proprietary wireless protocol that is not encrypted. The company is considering adding encryption to the protocol, but this will increase the computational load on the sensors and reduce their battery life. The company's primary concern is preventing attackers from reading the data. Which approach should the company take?

   • ADo not add encryption, as the data is not sensitive
   • BUse a different wireless protocol that is not encrypted
   • CAdd encryption to the protocol, accepting the reduced battery life
   • DAdd authentication instead of encryption
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security consultant is assessing the risks to a new IoT device that stores sensitive data on a local flash drive and transmits it to a central server. The device is deployed in a remote location with limited physical security. The consultant identifies the following threats: (1) physical theft of the device, (2) eavesdropping on the wireless transmission, and (3) memory scraping during processing. The consultant must recommend a single control that addresses the most critical threat. Which control should the consultant recommend?

   • AFull-disk encryption on the flash drive
   • BNetwork segmentation
   • CMemory protection mechanisms
   • DTLS for the wireless transmission
   Reveal Solution Discussion Select an answer first