Objective 6.1 Identify Common Threats Used to Exploit Unsecure Software/firmware. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of software flaw is characterized by incorrect program logic that produces unintended behavior, such as a thermostat that never turns off the heater?

   • ABuffer overflow
   • BRace condition
   • CInjection flaw
   • DLogic error
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A city deploys thousands of smart parking sensors that run on batteries and have no network interface other than a low-power radio. The vendor discovers a critical vulnerability in the sensor firmware that could allow an attacker to spoof sensor data. The vendor releases a patch, but the sensors cannot be updated remotely. What is the most significant security concern?

   • AThe sensors will remain vulnerable for a long time because patches require physical access
   • BThe sensors will be unable to communicate with the backend
   • CThe sensors will be automatically patched by the backend
   • DThe sensors' batteries will drain faster due to the vulnerability
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary security consequence for an IoT device that lacks over-the-air (OTA) update capabilities?

   • AThe device's firmware is automatically encrypted
   • BThe device is immune to malware
   • CThe device cannot connect to the internet
   • DKnown vulnerabilities remain unpatched, leaving the device exposed to exploits
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A developer is writing firmware for a new IoT device that will be deployed in a harsh environment. The device has limited memory and processing power. The developer needs to parse incoming data from a sensor. Which approach is most likely to introduce a buffer overflow vulnerability?

   • AUsing a dynamic buffer that grows as needed
   • BUsing a library function that automatically handles memory allocation
   • CUsing a separate buffer for each data type
   • DUsing a fixed-size buffer and copying data without checking the length
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why are constrained IoT devices with limited memory and processing power often more vulnerable to attacks?

   • AThey use proprietary operating systems
   • BThey are always connected to the internet
   • CThey are manufactured by smaller vendors
   • DThey may lack the resources to implement security features like encryption and authentication
   Reveal Solution Discussion Select an answer first