A security operations team needs to verify that a fleet of IoT devices booted into a known-good state before allowing them to connect to the corporate network. The devices use measured boot and can provide attestation reports. What is the most effective way for the team to use this capability?

Confirm that the device has a valid IP address and can ping the network gateway.

Check the device's uptime to ensure it has not rebooted recently, indicating a stable state.

Request the attestation report from each device and compare the measured boot values against a known-good baseline.

Verify that the device's firmware version is the latest available from the manufacturer.

What is a root of trust in the context of IoT device security?

A database of all known malware signatures

The first user account created on the device

The manufacturer's website that hosts firmware updates

A hardware or software component that is inherently trusted and serves as the foundation for all security verifications

A security architect is designing a system where IoT devices must prove their boot state to a remote server before receiving sensitive data. The devices use secure boot and measured boot. The architect wants to ensure that the attestation report cannot be forged by a compromised device. What is the most important additional control to implement?

Require the device to send the attestation report over a TLS connection.

Use a TPM to sign the attestation report with an attestation identity key (AIK) that is protected by the TPM.

Include the device's IP address and MAC address in the attestation report.

Encrypt the attestation report with a symmetric key shared between the device and the server.

What is a common mechanism used to remotely update the bootloader of an IoT device?

A/B partitioning with a fallback bootloader

Using a USB stick that must be inserted manually

Sending the bootloader as a plain text email attachment

Overwriting the bootloader directly without any recovery option

Which combination of measures is essential for a secure update process?

Logging, monitoring, and alerting

Firewall, antivirus, and intrusion detection

Compression, deduplication, and caching

Encryption, authentication, and integrity checks

CertNexusCertified IoT Security Practitioner (CIoTSP)

Domain 6Objective 2

Objective 6.2 Implement Countermeasures Used to Provide Secure Software/firmware. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Part of the 6.0 Securing Software/Firmware domain, which accounts for 10% of the CERTIFIED-IOT-SECURITY-PRACTITIONER exam.

27questions here

6free pages

7concepts

10%of the exam

Questions 1–5

1application · medium
A security operations team needs to verify that a fleet of IoT devices booted into a known-good state before allowing them to connect to the corporate network. The devices use measured boot and can provide attestation reports. What is the most effective way for the team to use this capability?
Select an answer first
2foundation · easy
What is a root of trust in the context of IoT device security?
Select an answer first
3expert · hard
A security architect is designing a system where IoT devices must prove their boot state to a remote server before receiving sensitive data. The devices use secure boot and measured boot. The architect wants to ensure that the attestation report cannot be forged by a compromised device. What is the most important additional control to implement?
Select an answer first
4foundation · easy
What is a common mechanism used to remotely update the bootloader of an IoT device?
Select an answer first
5foundation · easy
Which combination of measures is essential for a secure update process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-IOT-SECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CERTIFIED-IOT-SECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.