Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which password policy element is most effective at resisting brute-force and dictionary attacks?

   • ARequiring the password to contain the username
   • BRequiring a minimum password length of 12 characters
   • CRequiring the password to be exactly 8 characters with at least one symbol
   • DRequiring the password to be changed every 30 days
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which combination of countermeasures is most effective for preventing XSS and SQL injection attacks on a web interface?

   • AEncrypting all data at rest
   • BStrong password policy and account lockout
   • CNetwork segmentation and firewall rules
   • DInput validation and output encoding
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An IoT portal's login page is being targeted by a brute-force attack that locks out legitimate users, causing a denial of service. The security team wants to mitigate the attack without enabling account enumeration or permanently locking out valid users. Which approach is most effective?

   • ALock the account after 3 failed attempts and require an admin to unlock it, but show a specific error for unknown usernames.
   • BUse a CAPTCHA after every failed attempt, and display a message that says 'username or password is incorrect'.
   • CRate-limit login attempts by IP address, and return a different error message for valid usernames to help users.
   • DImplement progressive delays after failed attempts, and return a generic error message for both invalid username and invalid password.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of enforcing password expiration in an organization?

   • ATo reduce the need for account lockout policies
   • BTo limit the window of opportunity if a password is compromised
   • CTo ensure passwords are stored in plain text
   • DTo make passwords easier to remember
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which response is an example of account enumeration prevention?

   • ADisplaying "Password incorrect" when the username is valid
   • BDisplaying "Username not found" when the username is invalid
   • CDisplaying "Invalid username or password" for both incorrect username and incorrect password
   • DDisplaying "Account locked" when the account is locked
   Reveal Solution Discussion Select an answer first