Objective 1.2 Implement Countermeasures Used to Secure Web, Cloud, or Mobile Interfaces. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A smart building's IoT portal allows facility managers to control HVAC systems. The portal has a legacy web form that is vulnerable to CSRF, and the team wants to add 2FA for all users. However, some users access the portal via a mobile app that does not support cookies. Which solution addresses both CSRF and 2FA without breaking the mobile app?

   • AImplement a CSRF token in a custom header for all state-changing requests, and use a one-time passcode from an authenticator app for 2FA.
   • BRely on the browser's built-in CSRF protection, and require users to enter a PIN after login.
   • CAdd a CAPTCHA to all forms to prevent CSRF, and use a hardware token for 2FA.
   • DUse a same-site cookie attribute for CSRF protection, and send 2FA codes via SMS.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's IoT portal is accessed by field technicians who often work in low-connectivity areas. The security policy requires strong passwords and protection against brute-force attacks, but the technicians complain that frequent password changes are disruptive. Which combination of measures best balances security and usability?

   • AEnforce a minimum length of 12 characters and complexity, but do not require periodic expiration; implement account lockout after 5 failed attempts for 15 minutes.
   • BUse a simple 6-character PIN for ease of memory, and rely on 2FA via SMS to provide security.
   • CRequire password changes every 30 days and lock accounts after 3 failed attempts until an admin resets them.
   • DEnforce a 10-character password with no complexity, and disable account lockout to avoid locking out technicians in the field.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security assessment of an IoT vendor's portal found that the login response time is faster for valid usernames than for invalid ones, and the password reset page reveals whether an email is registered. Which countermeasure directly addresses both findings?

   • AAdd a CAPTCHA to the login and reset pages to slow down automated enumeration attempts.
   • BEnsure all authentication and recovery responses are uniform in timing and content, regardless of whether the account exists.
   • CUse a generic error message on login, but keep the specific response on the reset page to help users.
   • DLock accounts after a few failed login attempts to prevent attackers from testing many usernames.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the recommended way to store user passwords in a database?

   • AEncrypted with a reversible algorithm
   • BHashed with a unique salt per user
   • CAs plain text for easy retrieval
   • DHashed without salt
   Reveal Solution Discussion Select an answer first