Objective 7.2 Implement Countermeasures Used to Ensure Physical Security. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A retail store has IoT security cameras connected to a central recording server. The server is in a back office that is sometimes left unlocked. The store manager wants to prevent someone from physically accessing the server's USB ports and console. What is the most practical countermeasure?

   • ADisable the USB ports in the server's BIOS and set a BIOS password
   • BInstall a lockable server rack and require keycard access to the back office
   • CMove the server to a public area so it is under constant surveillance
   • DApply a tamper-evident sticker over the server's power button
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A university research lab has IoT environmental sensors in a shared lab space. The sensors have USB ports for data download and are managed via SSH. The lab is shared with other research groups, and the PI wants to prevent unauthorized data exfiltration while allowing legitimate research access. The lab cannot afford a full-time security guard. What is the most practical layered approach?

   • ARely on the lab's existing CCTV system and post a sign stating that the area is monitored
   • BPlace the sensors in a locked cabinet with a keypad lock, disable USB data transfer, and require SSH key-based authentication for management
   • CUse a shared SSH password for all lab members and rely on the lab's access control list
   • DDisable SSH and require all data downloads to be done via a USB drive that is kept in a locked drawer
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A smart grid company manages remote substation IoT gateways. Each gateway has SSH enabled for vendor support. The company is concerned about both external attackers and insider threats. They want to maintain vendor access but also ensure that no single vendor engineer can permanently lock out company administrators. What is the best approach?

   • AGive the vendor full administrative access and rely on their internal security policies
   • BUse a shared vendor account with a password that is changed after each vendor visit
   • CCreate a 'break-glass' local admin account with a strong password stored in a sealed envelope, and use individual vendor accounts with limited permissions
   • DDisable SSH for the vendor and require them to be on-site for all support
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which mechanism is used to enforce role-based access control (RBAC) on an IoT device?

   • ADisabling all user accounts except the default admin
   • BAssigning permissions based on the user's role within the organization
   • CUsing the same password for all users
   • DGiving all users full administrative rights
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice is essential for hardening shell access on an IoT device?

   • AAllowing shell access from any IP address
   • BUsing Telnet for remote shell access
   • CDisabling all authentication to simplify access
   • DUsing strong authentication, such as SSH keys or strong passwords
   Reveal Solution Discussion Select an answer first