Objective 6.1 Identify Common Threats Used to Exploit Unsecure Software/firmware. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vendor distributes firmware updates for its line of IP cameras. The update file is downloaded over HTTP from a vendor website, and the camera applies it without verifying any signature. An attacker performs a man-in-the-middle attack and replaces the update with malicious firmware. Which two weaknesses in the update mechanism directly enable this attack?

   • ALack of authentication and lack of secure boot
   • BLack of integrity checks and lack of authentication
   • CLack of encryption and lack of authentication
   • DLack of encryption and lack of integrity checks
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturer of smart locks uses an update mechanism where the device downloads a firmware image from a cloud server over HTTPS. The image is encrypted, but the device does not verify a digital signature. An attacker compromises the cloud server and replaces the firmware image with a malicious one. The device downloads and installs it. Which weakness in the update mechanism is most directly responsible?

   • ALack of encryption of the firmware image
   • BLack of OTA update capability
   • CUse of HTTPS instead of a custom protocol
   • DLack of authentication of the firmware image
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which security property is provided by digitally signing firmware?

   • AAvailability
   • BIntegrity and authenticity
   • CNon-repudiation only
   • DConfidentiality
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team is developing firmware for a new IoT sensor. The firmware processes JSON input from a web interface. The developer uses a function that concatenates user input directly into a SQL query without sanitization. The sensor has limited memory and no web application firewall. What is the most likely vulnerability?

   • ASQL injection due to lack of input validation
   • BBuffer overflow due to fixed-size buffers
   • CCross-site scripting due to unescaped output
   • DInsecure deserialization due to JSON parsing
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which practice is most likely to lead to the exposure of sensitive data if firmware is extracted from a device?

   • AEncrypting the firmware with a key stored in a hardware security module
   • BStoring API keys in plaintext within the firmware image
   • CUsing a secure boot process
   • DSigning the firmware with a private key
   Reveal Solution Discussion Select an answer first