Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital deploys IoT infusion pumps managed via a web portal. The IT team includes network engineers who should only view device status, and biomedical engineers who should update device firmware and change settings. The security policy requires least privilege. What should the portal administrator configure?

   • AAssign each user a unique password and allow them to perform any action they want.
   • BCreate two roles: 'viewer' with read-only access to device status, and 'biomed_admin' with permissions to update firmware and change settings.
   • CGive all IT staff full admin rights to simplify management, since they are all trusted employees.
   • DUse a single shared admin account for all IT staff to reduce the number of accounts to manage.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the principle of least privilege in role-based access control?

   • AAll users have the same level of access to simplify management
   • BUsers can request temporary access to any resource
   • CAdministrators have access to all data at all times
   • DUsers are granted only the permissions necessary to perform their job functions
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization is deploying a new IoT portal and wants to establish a password policy for user accounts. The policy must resist dictionary attacks and credential stuffing, but users often work from shared computers. Which password policy is most effective?

   • AUse a passphrase of 4 random words, but do not enforce 2FA.
   • BRequire a minimum length of 14 characters, prohibit common passwords, and enable 2FA.
   • CRequire password changes every 60 days and use a password history of 5.
   • DRequire a mix of uppercase, lowercase, digits, and symbols, but allow a minimum length of 8 characters.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A water treatment facility uses an IoT portal to monitor and control pumps. The control room operators need to start/stop pumps, while maintenance technicians only need to view sensor data. The security team wants to enforce least privilege but also wants to avoid locking out operators during an emergency. Which access control design is most appropriate?

   • AGive all employees full admin rights to ensure no one is locked out during an emergency.
   • BUse role-based access control but set the lockout threshold to 3 attempts to prevent brute-force.
   • CCreate an 'operator' role with pump control permissions and a 'technician' role with read-only access, and implement a break-glass account with full access for emergencies.
   • DCreate a single 'admin' role for everyone, but require two-person approval for pump control actions.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturer deploys IoT gateways to a customer site. Each gateway ships with the same default admin password, and the customer's IT team will manage the devices remotely. The security lead wants to ensure that no device remains accessible with a known credential and that each admin has only the permissions needed for their role. Which approach best meets these requirements?

   • AGenerate a unique strong password for each gateway, store the credentials in a central password manager with access limited to authorized admins, and configure role-based permissions so each admin has only the functions they need.
   • BUse the same strong password for all gateways to simplify management, and rely on the customer's Active Directory for authentication and authorization.
   • CChange the default password to a unique strong password per device, store the hashes in the device's local config, and give all IT staff full admin rights.
   • DLeave the default password in place but restrict access to the admin interface via a firewall rule that only allows the customer's IP range.
   Reveal Solution Discussion Select an answer first