Objective 3.1 Identify Common Threats Used to Exploit Unsecure Network Services. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A smart agriculture deployment uses LoRaWAN for sensor communication. An attacker exploits the lack of authentication in the LoRaWAN network server to send forged join requests, causing the server to allocate resources to fake devices and exhaust its capacity. Which type of attack is this?

   • AA buffer overflow attack that crashes the network server
   • BA MAC spoofing attack that impersonates a legitimate sensor
   • CA denial-of-service attack that exhausts the network server's resources
   • DA packet injection attack that alters sensor data
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is monitoring traffic on an IoT network and notices that an attacker is sending crafted packets that appear to come from a trusted sensor, but the payload contains malicious commands that alter the behavior of a controller. Which attack technique is being used?

   • APacket injection to insert malicious data into the network stream
   • BUPnP abuse to open ports on the controller
   • CBuffer overflow to overwrite the controller's memory
   • DA DoS attack to overwhelm the controller with traffic
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which memory management flaw is exploited by a buffer overflow attack?

   • AIncorrect configuration of firewall rules
   • BWeak password hashing algorithms
   • CLack of bounds checking when writing data to a buffer
   • DExcessive use of encryption keys
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security engineer is assessing a network that uses TFTP for firmware updates on IoT devices. The engineer notices that an attacker can send a flood of TFTP requests to a device, causing it to become unresponsive. Which characteristic of TFTP makes this attack possible?

   • ATFTP uses UDP, which lacks connection state and is easy to flood
   • BTFTP uses UPnP to open ports on the firewall
   • CTFTP has a buffer overflow vulnerability that crashes the service
   • DTFTP uses TCP, which allows attackers to spoof source addresses easily
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which common network service is frequently targeted by attackers because it often runs with elevated privileges and historically has had weak authentication and unencrypted data transmission?

   • ASSH
   • BHTTPS
   • CDNS
   • DTelnet
   Reveal Solution Discussion Select an answer first