Objective 2.1 Identify Common Threats Used to Exploit Weak Authentication/authorization Schemes. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is auditing access important in an IoT system?

   • AIt prevents all attacks from occurring
   • BIt helps detect unauthorized access attempts
   • CIt improves the device's battery life
   • DIt encrypts all data in transit
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to detect unauthorized access to an IoT management system. Which of the following would be the most effective way to achieve this?

   • ADisable all external access to the management system.
   • BUse network segmentation to isolate the management system.
   • CImplement a strong password policy.
   • DEnable detailed audit logging of all authentication and authorization events, and review the logs regularly.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does the lack of two-factor authentication (2FA) increase the risk of unauthorized access?

   • AIt makes passwords easier to remember.
   • BIt prevents the use of biometric authentication.
   • CIt allows attackers to bypass the need for a password.
   • DIt means a stolen password alone is sufficient to gain access.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's remote access VPN for IoT administrators uses only a username and password. An attacker has obtained a valid administrator's password through a phishing email. Which additional control would most effectively prevent the attacker from gaining access?

   • ARestrict VPN access to specific IP addresses.
   • BEnforce a strong password policy and require password changes every 30 days.
   • CImplement account lockout after 3 failed attempts.
   • DRequire a one-time passcode from an authenticator app in addition to the password.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small business deploys a fleet of IoT cameras. All employees, including the receptionist, have full administrative access to the camera management system. An employee accidentally changes the camera settings, causing a security gap. Which principle would have most directly prevented this?

   • AAudit logging of all configuration changes.
   • BStrong password policy for all accounts.
   • CLeast privilege, giving each employee only the permissions needed for their job.
   • DMulti-factor authentication for all employees.
   Reveal Solution Discussion Select an answer first