Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why must account lockout thresholds be configured carefully to avoid a denial of service?

   • AAn attacker could intentionally trigger lockouts on legitimate accounts, preventing users from logging in
   • BLockout policies prevent users from changing passwords
   • CLockout policies reveal the password hash
   • DLockout policies consume too much CPU
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During the deployment of a new IoT portal, which action is the most direct countermeasure to prevent attackers from using known factory-set credentials?

   • AChanging all default passwords to unique, strong values before connecting devices to the network
   • BEnabling TLS on the portal's web interface
   • CPlacing the portal behind a firewall
   • DDisabling the portal's remote management interface
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary security goal of a secure password recovery mechanism?

   • ATo allow unlimited attempts so users are never locked out
   • BTo send the current password to the user's email address
   • CTo provide a direct link to reset the password without any verification
   • DTo verify the user's identity without revealing whether an account exists or allowing repeated automated attempts
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a second authentication factor?

   • AThe user's security question answer
   • BThe user's IP address
   • CA one-time passcode generated by an authenticator app
   • DThe user's password
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An IoT vendor's mobile app communicates with a cloud backend. The app currently sends user credentials in plaintext over HTTP, and the backend stores passwords in a database. The security team wants to protect credentials in transit and at rest without requiring users to change passwords. Which combination of measures is most appropriate?

   • AUse a custom encryption algorithm in the app to encrypt credentials before sending, and store passwords in plaintext in the database.
   • BUse HTTPS for login only, and store passwords in a separate database with restricted access.
   • CEnforce HTTPS with TLS for all app-to-backend communication, and migrate the password storage to salted hashes using a strong algorithm.
   • DSend credentials via a VPN tunnel, and store passwords using reversible encryption with a key stored on the server.
   Reveal Solution Discussion Select an answer first