Objective 2.1 Identify Common Threats Used to Exploit Weak Authentication/authorization Schemes. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can an attacker exploit an insecure password recovery process?

   • ABy using a stronger password than the original
   • BBy guessing the answers to security questions that are based on public information
   • CBy changing the username to something else
   • DBy requesting a password reset and then ignoring the email
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has implemented audit logging but does not have a process for reviewing the logs. An attacker compromises an account and accesses sensitive data. The breach is discovered months later by an external party. Which of the following is the most significant gap in the company's security posture?

   • ALack of network segmentation.
   • BLack of security monitoring to actively review and analyze logs for suspicious activity.
   • CLack of a strong password policy.
   • DLack of multi-factor authentication.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital's IoT medical device management system uses a single administrative account for all technicians. A technician who recently left the organization still has access because the account was not disabled. The technician used this access to view patient records and alter device settings beyond their job role. Which combination of controls would have most effectively prevented this scenario?

   • AUse a shared account with a complex password and restrict access to specific IP addresses.
   • BEnable detailed audit logging and review logs monthly.
   • CEnforce a strong password policy and require periodic password changes.
   • DImplement role-based access control with least privilege and disable accounts promptly upon termination.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A smart home device manufacturer's support portal allows users to reset their device passwords by answering security questions such as 'What is your mother's maiden name?'. An attacker has been observed successfully resetting several users' passwords after scraping social media profiles. Which improvement would most effectively reduce this risk?

   • ASend an email notification whenever a password reset occurs.
   • BAllow users to reset via a link sent to their email, but require them to enter the old password first.
   • CIncrease the number of security questions from one to three.
   • DRequire users to provide a one-time code sent to their registered email or phone during password reset.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A smart city project stores sensor data in a cloud database that is publicly accessible without authentication. An attacker discovered the database and exfiltrated sensitive data. Which of the following is the most immediate and effective control to prevent this type of exposure?

   • AImplement network-level security groups to restrict access to the database from specific IP ranges.
   • BRequire authentication and restrict access to the database to only authorized applications and users.
   • CEnable audit logging on the database to track access.
   • DEncrypt the data at rest using a strong encryption algorithm.
   Reveal Solution Discussion Select an answer first