Objective 4.2 Implement Countermeasures Used to Secure Data. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company manages a fleet of IoT cameras that encrypt video at rest using AES-256. A camera is decommissioned and returned to the vendor for repair. The security team wants to ensure that the encryption key cannot be recovered from the device. Which key management practice should be applied before sending the device out?

   • ARotate the key to a new value and store the old key in the cloud.
   • BCryptographically erase the key by deleting it from the device's secure storage.
   • CChange the device's password to prevent unauthorized access.
   • DRe-encrypt the video with a new key and keep the old key in a key vault.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company stores sensitive data on IoT devices that use a database. The data must be encrypted at rest, and the encryption keys must be managed centrally. The devices have a secure element. Which approach should be used?

   • AUse a single key for all devices and store it in a central server.
   • BUse the secure element to generate and store the encryption key, and use a key management system to manage key rotation.
   • CStore the encryption key in the database with the data.
   • DUse a passphrase to encrypt the data and store the passphrase in the device's firmware.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary characteristic of homomorphic encryption?

   • AIt protects data at rest by encrypting the entire disk
   • BIt encrypts data in transit using a secure tunnel
   • CIt uses the same key for encryption and decryption
   • DIt allows computations to be performed on encrypted data without decrypting it
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company processes sensitive data on IoT devices that use a TEE. The TEE requires a key to decrypt data before processing. The key is stored in the TEE's secure storage. The company wants to ensure that the key is protected even if the TEE is compromised. Which additional measure should be implemented?

   • AUse a key wrapping scheme where the TEE's key is encrypted with a key held by a remote key management service.
   • BUse a longer key to make it harder to brute-force.
   • CRotate the key frequently to limit the window of exposure.
   • DStore the key in the TEE's non-volatile memory without additional protection.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which encryption algorithm is widely used for encrypting data at rest on storage devices?

   • AAES
   • BSHA-256
   • CRSA
   • DMD5
   Reveal Solution Discussion Select an answer first