Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An IoT management portal is accessed by administrators from various locations. The security team wants to add an extra layer of verification beyond passwords to reduce the risk of credential theft. Which implementation is most appropriate for this scenario?

   • ARequire users to answer a set of personal security questions after entering their password.
   • BSend a one-time passcode via SMS to the user's registered phone number each time they log in.
   • CUse a CAPTCHA after password entry to verify the user is human.
   • DRequire a one-time passcode generated by an authenticator app on the user's smartphone in addition to the password.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester found that the IoT portal's registration page returns 'Username already exists' for taken usernames and 'Username available' for new ones. This allows attackers to build a list of valid usernames. Which change should be made to the registration page?

   • AShow a list of similar usernames to help the user choose a unique one.
   • BReturn 'Username already exists' only after the user completes a CAPTCHA.
   • CDelay the response by a few seconds for both cases to make timing uniform.
   • DReturn a generic message such as 'If the username is available, a confirmation email will be sent' for both cases.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer is building a web interface for an IoT management portal. The portal allows admins to view device telemetry and change device settings. The security review requires protection against cross-site scripting (XSS) and SQL injection, and also mandates that only users with the 'device_admin' role can change settings. Which implementation strategy best satisfies these requirements?

   • AEscape all input before storing it in the database, and rely on client-side JavaScript validation to enforce role permissions.
   • BUse an ORM to abstract database queries, and add a CAPTCHA to the settings change form to prevent automated attacks.
   • CUse parameterized queries for all database access, encode all user-supplied output, and enforce role-based access control on the server-side for settings changes.
   • DUse stored procedures for database access, disable JavaScript in the browser, and hide the settings button for non-admin users.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the goal of account enumeration prevention in login and registration forms?

   • ATo ensure that responses are identical whether an account exists or not
   • BTo provide helpful error messages that guide users to correct their input
   • CTo speed up the login process
   • DTo ensure that only valid users can access the system
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary security benefit of two-factor authentication (2FA)?

   • AIt eliminates the need for strong passwords
   • BIt prevents all phishing attacks
   • CIt ensures that only authorized devices can access the portal
   • DIt requires two different types of credentials, making it harder for an attacker to gain access even if one factor is compromised
   Reveal Solution Discussion Select an answer first