Objective 2.1 Identify Common Threats Used to Exploit Weak Authentication/authorization Schemes. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does the lack of an account lockout policy enable brute-force attacks?

   • AIt allows an attacker to make unlimited login attempts without being blocked
   • BIt encrypts the password database
   • CIt prevents the use of strong passwords
   • DIt makes passwords easier to guess
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does the lack of security monitoring allow attacks to go unnoticed?

   • AIt means there is no active review of system activity for signs of compromise
   • BIt disables the firewall
   • CIt makes the system more vulnerable to malware
   • DIt prevents the system from generating logs
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How do excessive privileges contribute to privilege escalation attacks?

   • AThey provide a larger attack surface for an attacker to exploit.
   • BThey prevent attackers from accessing the system.
   • CThey automatically encrypt all data.
   • DThey make passwords harder to guess.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is privilege escalation?

   • AThe process of removing user access rights
   • BThe process of granting all users the same level of access
   • CThe act of an attacker gaining higher-level permissions than originally granted
   • DThe act of encrypting user credentials
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which password recovery mechanism is considered insecure because it relies on information that is often publicly available?

   • AAsking for answers to security questions like 'What is your mother's maiden name?'
   • BRequiring a one-time code sent via SMS
   • CSending a reset link to the registered email address
   • DAllowing the user to set a new password after verifying their identity via a phone call
   Reveal Solution Discussion Select an answer first