Objective 5.2 Implement Countermeasures Used to Ensure Data Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A smart building system stores access logs that include employee IDs and entry times. The facility manager needs to review logs for security incidents, but HR policies require that access to this data be limited and that logs be retained for only 6 months. Which control best meets both requirements?

   • AEncrypt the logs and store them on a secure server with no access restrictions.
   • BImplement role-based access control (RBAC) so only the facility manager and HR have access, and set up automated deletion of logs older than 6 months.
   • CAllow all employees to view the logs to promote transparency, and delete logs after 1 year.
   • DKeep logs indefinitely for future security investigations.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare IoT system transmits patient vital signs from wearable devices to a cloud backend. The system must ensure that only authorized clinicians can view the data, and that the data is protected from interception during transmission. Which combination of controls should the system implement?

   • AEncrypt data at rest using AES-256 and use strong passwords for all user accounts.
   • BEncrypt data in transit using TLS and enforce role-based access control (RBAC) on the backend.
   • CUse a VPN for all connections and implement multi-factor authentication (MFA) for clinicians.
   • DMask patient names in the backend and use a firewall to restrict access to the cloud.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A smart thermostat manufacturer is designing a new model. To align with the principle of data minimization, which approach should the manufacturer take when deciding what data the thermostat collects?

   • ACollect only the data required to deliver the thermostat's core functionality, such as temperature and occupancy
   • BCollect all available sensor data in case it becomes useful for future features
   • CCollect data without considering the purpose, as long as it is stored securely
   • DCollect as much personal data as possible to improve marketing and personalization
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A smart agriculture company uses soil sensors to optimize irrigation. The sensors also record GPS coordinates of each sensor and the farmer's name. The company wants to reduce privacy risks. Which approach best aligns with data minimization?

   • AEncrypt the GPS coordinates and farmer's name in the database.
   • BCollect additional data such as soil pH and moisture to improve analytics.
   • CRemove the farmer's name from the sensor data and keep only the GPS coordinates for field mapping.
   • DRetain the farmer's name and GPS coordinates for 10 years for historical analysis.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A smart grid company stores customer energy usage data. The retention period has expired, and the data must be disposed of securely. The data is stored on solid-state drives (SSDs) in a server. What is the most effective disposal method?

   • ADelete the files and reformat the drives.
   • BUse the SSD's built-in secure erase command, then physically destroy the drives.
   • COverwrite the SSDs with random data multiple times.
   • DDegauss the SSDs.
   Reveal Solution Discussion Select an answer first