Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which implementation best supports a secure password recovery flow?

   • ADisplaying "Account not found" when the username is invalid
   • BReturning a generic message like "If the account exists, an email has been sent" and rate-limiting recovery requests
   • CSending the user's current password in plain text to their registered email
   • DAllowing unlimited password reset attempts to ensure users can always recover access
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary security benefit of an account lockout policy?

   • AIt prevents users from changing their passwords too often
   • BIt prevents brute-force attacks by locking the account after a threshold of failed attempts
   • CIt encrypts all password data
   • DIt ensures users remember their passwords
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An IoT vendor's cloud portal stores user passwords. A recent audit found that passwords are stored in plaintext in the database, and the same password is used for the portal and the device's local admin account. The security team wants to improve credential protection without disrupting user experience. Which change is most appropriate?

   • AEncrypt passwords with a symmetric key stored in the application code, and keep the same password for portal and device for convenience.
   • BStore passwords in a separate database table with restricted access, and keep the same password for portal and device to reduce help desk calls.
   • CHash passwords with a strong one-way algorithm and a unique salt per user, and enforce a policy that portal and device passwords must be different.
   • DUse a simple hash like MD5 without salt to reduce storage overhead, and allow users to reuse their portal password for device access.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of using anti-CSRF tokens in a web interface?

   • ATo validate that input data matches a predefined format
   • BTo prevent users from submitting the same form twice
   • CTo encrypt all data transmitted between the browser and the server
   • DTo ensure that requests submitted to the server originate from the authenticated user's session
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which practice is the best way to handle the default administrator password on a newly installed IoT portal component?

   • AUse the same strong password for all components to simplify management
   • BDisable the admin account and rely on guest access for initial configuration
   • CChange the default password to a strong, unique password and document it in a secure password manager
   • DKeep the default password but restrict access to the admin account via IP allowlisting
   Reveal Solution Discussion Select an answer first