A security researcher purchases a consumer smart lock and extracts the firmware using the debug UART port. Inside the firmware image, she finds the device's cloud API key and the Wi-Fi password for the owner's home network. Which two weaknesses are demonstrated by this finding?

Firmware contains sensitive information and unsecure key storage

Unsecure updates and lack of digital signature

Poorly designed software and lack of end-to-end solution

Lack of OTA updates and unsecure bootloader

Which security feature is most likely to be absent on a resource-constrained IoT sensor due to limited processing power?

A web-based management interface

Strong encryption for data at rest and in transit

What is the primary security purpose of requiring authentication and digital signatures for firmware updates?

To compress the update file for faster download

To prevent the update from being installed on unauthorized devices

To encrypt the update so that only the device can read it

To ensure the update comes from a trusted source and has not been altered

A company deploys a network of low-cost soil moisture sensors for agriculture. Each sensor has 64 KB of RAM, no cryptographic accelerator, and runs a minimal real-time operating system. The sensors communicate using a simple proprietary protocol with no encryption or authentication. An attacker easily impersonates a sensor and injects false readings. Which two factors most directly contribute to this vulnerability?

Lack of OTA updates and unsecure bootloader

Constrained device lacks security features and poorly designed protocol

Lack of end-to-end solution and unsigned firmware

Firmware contains sensitive information and unsecure key storage

In an IoT ecosystem, what is a common consequence of securing the device but not the backend server?

Attackers may compromise the backend to access data or control devices

Network traffic is automatically encrypted

Devices become immune to attacks

Firmware updates become unnecessary

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 6Objective 1

Objective 6.1 Identify Common Threats Used to Exploit Unsecure Software/firmware. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 5)

Part of the 6.0 Securing Software/Firmware domain, which accounts for 10% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

30questions here

6free pages

9concepts

10%of the exam

Questions 21–25

21application · medium
A security researcher purchases a consumer smart lock and extracts the firmware using the debug UART port. Inside the firmware image, she finds the device's cloud API key and the Wi-Fi password for the owner's home network. Which two weaknesses are demonstrated by this finding?
Select an answer first
22foundation · easy
Which security feature is most likely to be absent on a resource-constrained IoT sensor due to limited processing power?
Select an answer first
23foundation · easy
What is the primary security purpose of requiring authentication and digital signatures for firmware updates?
Select an answer first
24application · medium
A company deploys a network of low-cost soil moisture sensors for agriculture. Each sensor has 64 KB of RAM, no cryptographic accelerator, and runs a minimal real-time operating system. The sensors communicate using a simple proprietary protocol with no encryption or authentication. An attacker easily impersonates a sensor and injects false readings. Which two factors most directly contribute to this vulnerability?
Select an answer first
25foundation · easy
In an IoT ecosystem, what is a common consequence of securing the device but not the backend server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.