Objective 2.2 Implement Countermeasures Used to Provide Secure Authentication, Authorization, and Accounting. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A pharmaceutical company has IoT-controlled freezers storing sensitive vaccines. The system has three user types: technicians (can view temperature and adjust settings for their assigned freezers), supervisors (can adjust any freezer but cannot change user roles), and administrators (full access including user management). The company wants to enforce least privilege while ensuring that any change to freezer settings requires re-authentication. Which combination of countermeasures best meets these requirements?

   • AUse a single administrator account for all users and enable detailed logging of all actions.
   • BImplement RBAC and require users to re-enter their password only when logging in at the start of a shift.
   • CImplement ABAC that grants permissions based on the user's department and require a strong password policy.
   • DImplement RBAC with roles for technician, supervisor, and administrator, and require MFA re-authentication for any setting change.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A smart building management system allows facility managers to remotely unlock doors and adjust HVAC settings. The system currently requires only a single login at the start of a shift. Management is concerned that a stolen session could allow an attacker to unlock all doors. Which countermeasure should be implemented to reduce this risk?

   • ARequire re-authentication (e.g., MFA) before performing sensitive actions like unlocking doors.
   • BImplement attribute-based access control (ABAC) to restrict door unlocking based on the user's location.
   • CEnable comprehensive event logging for all door unlock attempts.
   • DIncrease the password complexity requirement for all users.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital's IoT network includes medical devices that are critical for patient care. The security team wants to be notified immediately of any failed authentication attempt, but they are concerned about alert fatigue from the high volume of benign failures (e.g., a nurse mistyping a password). Which countermeasure should be implemented to balance timely notification with reduced noise?

   • ASend an alert for every failed authentication attempt to ensure no event is missed.
   • BConfigure alerts to trigger only after multiple failed attempts from the same device or user within a short time window.
   • CImplement continuous monitoring that only alerts on successful authentications from unusual locations.
   • DDisable alerts for failed authentication and rely on weekly log reviews.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution uses IoT ATMs that are managed remotely. The security team wants to enforce least privilege so that only authorized technicians can perform maintenance, and they want to ensure that any maintenance action is protected against session hijacking. They also want to reduce the risk of credential theft by implementing a strong password policy. Which combination of countermeasures best meets all these requirements?

   • AUse a shared maintenance account with a complex password, and enable logging of all actions.
   • BImplement RBAC to restrict maintenance actions to authorized technicians, require MFA re-authentication before any maintenance action, and enforce a strong password policy for all accounts.
   • CImplement RBAC and require users to re-authenticate only when logging in at the start of a shift.
   • DImplement ABAC based on the technician's location, and require a strong password policy.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is re-authentication required before performing sensitive actions, such as changing device firmware or modifying security settings?

   • ATo verify that the current user is still authorized for the action
   • BTo comply with password complexity requirements
   • CTo ensure the device has enough storage for logs
   • DTo reduce network traffic during the session
   Reveal Solution Discussion Select an answer first