Objective 6.2 Implement Countermeasures Used to Provide Secure Software/firmware. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is implementing a secure enclave on an IoT device to protect cryptographic keys. The enclave must perform signing operations without exposing the private key to the main application processor. Which statement best describes the correct use of the secure enclave?

   • AThe enclave generates and stores the private key internally and performs signing operations on behalf of the application.
   • BThe enclave uses the private key to encrypt data but cannot perform signing operations.
   • CThe enclave stores the private key in flash and reads it into memory for each signing operation.
   • DThe enclave exports the private key to the application when a signing operation is requested.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of performing an integrity check on a downloaded firmware update before installation?

   • ATo verify that the update has not been modified or corrupted during transmission
   • BTo encrypt the update so that only the device can read it
   • CTo ensure the update is compatible with the device's hardware
   • DTo confirm that the update is the latest version available
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An industrial IoT company needs to remotely update the firmware of thousands of sensors deployed across multiple sites. The update process must ensure that only authorized updates are installed and that the firmware is not modified during transmission. Which combination of measures best satisfies these requirements?

   • ARely on the security of the remote update server's network and use no additional cryptographic protections.
   • BEncrypt the update with a symmetric key and rely on the secrecy of the key for authenticity.
   • CUse a hash of the firmware published on the manufacturer's website and compare it locally on each device.
   • DUse a secure transport (TLS) and digitally sign the firmware with a private key; devices verify the signature before installation.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Before installing a digitally signed firmware update, what must the IoT device do to verify the signature?

   • ACompare the update's hash to a hash stored in a public database
   • BDecrypt the update using the vendor's private key
   • CCheck that the update file size matches the size listed on the vendor's website
   • DUse the vendor's public key to verify the signature over the update content
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does attestation use the measurements from measured boot?

   • AIt uses the measurements to encrypt the device's storage
   • BIt sends the measurements to a remote verifier to prove the device's trust state
   • CIt deletes the measurements after boot to save space
   • DIt displays the measurements on the device's screen for the user
   Reveal Solution Discussion Select an answer first