Objective 2.1 Identify Common Threats Used to Exploit Weak Authentication/authorization Schemes. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A user forgets the password to their IoT device management account. The password reset process asks for the user's date of birth and the last four digits of their social security number. An attacker who has obtained this information from a data breach successfully resets the user's password. Which of the following would be a more secure password recovery mechanism?

   • AAllow the user to reset the password by providing their username and a previously used password.
   • BAsk for the user's mother's maiden name.
   • CSend a one-time reset link to the user's verified email address.
   • DRequire the user to answer three security questions.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of a second authentication factor?

   • AThe user's username
   • BThe user's email address
   • CThe user's password
   • DA one-time code sent to a user's smartphone
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why does enforcing password complexity reduce the risk of credential compromise in an IoT system?

   • AIt ensures passwords are stored in an encrypted format on the device.
   • BIt prevents users from sharing passwords with each other.
   • CIt eliminates the need for multi-factor authentication.
   • DIt increases the number of possible passwords an attacker must try in a brute-force attack.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is reviewing the security posture of an IoT deployment. They notice that the system does not have any monitoring or alerting in place. Which of the following is the most significant risk resulting from this gap?

   • AAn attacker can compromise the system and remain undetected for an extended period, allowing them to exfiltrate data or cause damage.
   • BThe system is more vulnerable to brute-force attacks.
   • CThe system cannot generate audit logs for compliance.
   • DThe system cannot enforce access control policies.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What type of information is typically recorded in an access audit log?

   • AThe user's social security number
   • BThe user's password
   • CThe user ID, timestamp, and action performed
   • DThe user's biometric data
   Reveal Solution Discussion Select an answer first