Objective 3.1 Identify Common Threats Used to Exploit Unsecure Network Services. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   An attacker on a local network sends packets to a smart thermostat with a spoofed source IP address of the trusted cloud server. The thermostat accepts commands from the spoofed IP and changes the temperature settings. Which attack is being performed?

   • AMAC address spoofing to impersonate a trusted device
   • BIP address spoofing to impersonate a trusted server
   • CA DoS attack to overwhelm the thermostat
   • DA buffer overflow attack to execute code on the thermostat
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An attacker on the same Wi-Fi network as a smart lock sends packets with the MAC address of the authorized smartphone to the lock's access point. The lock's access point trusts the MAC address and grants access. Which attack is being performed?

   • AIP address spoofing to impersonate a trusted server
   • BMAC address spoofing to impersonate a trusted endpoint
   • CA packet injection attack to alter the lock's firmware
   • DA buffer overflow attack to crash the access point
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security consultant is reviewing an IoT deployment that uses MQTT for messaging. The consultant finds that the MQTT broker is exposed to the internet and has no authentication. An attacker connects to the broker and publishes malicious messages to a topic that controls a smart valve. Which vulnerability is being exploited?

   • AAn unsecure network service that is exposed and lacks authentication
   • BA buffer overflow in the MQTT broker that allows code execution
   • CA MAC spoofing attack that impersonates a legitimate client
   • DA UDP amplification attack that floods the broker
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A vulnerability researcher is testing an IoT device's network service. By sending a specially crafted packet with a payload longer than the service's input buffer expects, the researcher causes the service to crash. Which type of vulnerability is being exploited?

   • AA buffer overflow that overwrites adjacent memory and crashes the service
   • BA UDP amplification attack that floods the service with responses
   • CA packet injection attack that modifies the service's memory contents
   • DA denial-of-service via fuzzing that sends malformed inputs to exhaust resources
   Reveal Solution Discussion Select an answer first