Objective 2.1 Identify Common Threats Used to Exploit Weak Authentication/authorization Schemes. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An IoT device manufacturer's support portal allows users to set any password, including '1234'. An attacker has been running a dictionary attack against the portal. Which of the following is the most effective way to reduce the success of this attack?

   • AImplement a CAPTCHA on the login form.
   • BUse a longer session timeout.
   • CSend an email alert after multiple failed login attempts.
   • DEnforce a password policy that requires a minimum length of 12 characters and a mix of character types.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A developer for an IoT device manufacturer stores API keys in the device firmware in plaintext. An attacker extracts the firmware and obtains the keys, then uses them to access the backend cloud service. Which of the following is the most effective mitigation?

   • AStore the API keys in a secure hardware element on the device and use a secure boot process to protect the firmware.
   • BUse a complex API key that is difficult to guess.
   • CRotate the API keys on a regular schedule.
   • DObfuscate the API keys in the firmware using a custom encoding scheme.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a common risk of an unsecured database in an IoT system?

   • ASensitive data can be exposed to unauthorized users
   • BThe database will consume more power
   • CThe database will automatically delete its contents
   • DThe database will slow down the network
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a security measure to protect a database?

   • AIncreasing the database size
   • BConnecting the database to the internet
   • CEncrypting the data at rest
   • DUsing a faster processor
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer stores database credentials in a configuration file that is included in the source code repository. The repository is accidentally made public. An attacker finds the credentials and accesses the database. Which of the following is the most effective way to prevent this type of exposure?

   • AUse a secrets management service to store and retrieve credentials at runtime, and never hardcode them in source code.
   • BRestrict access to the database by IP address.
   • CEncrypt the configuration file with a strong encryption algorithm.
   • DUse a complex password for the database.
   Reveal Solution Discussion Select an answer first