Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A smart home device vendor's web portal allows users to reset passwords via email. Security testing revealed that the reset response differs between registered and unregistered email addresses, and an attacker could repeatedly trigger reset emails to a victim's address. Which set of countermeasures best addresses these findings?

   • AReturn a specific error for unregistered emails to help users correct typos, and add a CAPTCHA to the reset form.
   • BReturn a generic message for both registered and unregistered emails, and implement a rate limit on reset requests per email address.
   • CUse a generic response, and require the user to answer a personal security question before sending a reset link.
   • DSend a reset link only to registered emails, and lock the account after three failed reset attempts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which practice ensures that credentials are transmitted securely over the network?

   • AUsing HTTPS/TLS for all authentication traffic
   • BSending credentials only over a private network
   • CUsing HTTP but with a strong password
   • DEncoding credentials with Base64
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer is fixing a SQL injection vulnerability in an IoT portal's device search feature. The search box accepts a device name and queries a database. The developer also needs to ensure that only authenticated users can perform searches. Which implementation is most secure?

   • AUse a parameterized query with a prepared statement, and enforce authentication on the server-side before executing the search.
   • BEscape single quotes in the input, and rely on client-side JavaScript to check if the user is logged in.
   • CUse a stored procedure that concatenates the input, and hide the search box from unauthenticated users.
   • DUse an ORM with raw SQL queries, and add a CAPTCHA to the search form.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A logistics company uses an IoT portal to track vehicles. Drivers log in from mobile devices, and the security team wants to add 2FA without requiring hardware tokens. Which method is most suitable for this mobile workforce?

   • AUse a physical security key that plugs into the mobile device's USB port.
   • BRequire the driver to enter a personal identification number (PIN) after their password.
   • CSend a one-time passcode via SMS to the driver's phone.
   • DUse a time-based one-time passcode from an authenticator app installed on the driver's smartphone.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A manufacturing company's IoT portal is accessed by shift workers who rotate every 8 hours. The security team wants to enforce strong passwords and protect against brute-force, but workers often forget passwords after long breaks, leading to lockouts. Which policy best balances security and operational continuity?

   • AEnforce a 6-character PIN, lock accounts after 3 failed attempts until an admin resets, and require 2FA via SMS.
   • BEnforce password expiration every 30 days, lock accounts after 5 failed attempts for 1 hour, and require admin approval for unlock.
   • CEnforce a 12-character password policy, lock accounts after 10 failed attempts for 30 minutes, and allow self-service unlock via email verification.
   • DEnforce a 15-character password with no lockout, and rely on 2FA via authenticator app.
   Reveal Solution Discussion Select an answer first