Understand Common IoT Security and Privacy Countermeasures. ITP-110 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key aspect of secure session management in IoT web applications?

   • ATransmitting session tokens over HTTP
   • BStoring session tokens in URLs
   • CUsing long-lived sessions without expiration
   • DUsing secure cookies with HttpOnly and Secure flags
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A smart-home vendor provides a mobile app that controls door locks and cameras. The app communicates with a cloud backend via REST APIs. A security review found that the APIs accept requests without verifying that the caller is authorized to control the specific device, and that session tokens are valid for 30 days. The vendor wants to fix these issues without requiring users to re-authenticate on every request. Which combination of changes is the most appropriate?

   • ARequire the user to enter their password on every API request.
   • BEncrypt all API traffic with TLS and keep the 30-day session token.
   • CAdd a rate limit to the API and keep the 30-day session token.
   • DImplement per-device authorization checks in the API and reduce the session token lifetime to a few hours with a refresh mechanism.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturer produces a smart thermostat that runs a Linux-based OS. A security review found that the device exposes a debug SSH service on the network, runs a web server that is not used by the product, and allows the 'root' user to log in with a default password. The manufacturer wants to reduce the attack surface before shipping. Which set of actions is the most appropriate hardening step?

   • ADisable the debug SSH service, remove the unused web server, and enforce strong unique credentials for the root account.
   • BChange the root password to a longer default password and enable the firewall to block external access to all services.
   • CApply the latest OS patches and leave the services running, since patching addresses all known vulnerabilities.
   • DKeep the SSH service enabled but restrict it to the local network, and leave the web server running for future updates.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A temperature sensor sends readings to a central monitoring system over a wireless network. The system needs to detect if a reading has been accidentally corrupted during transmission. Which mechanism is the most appropriate for this specific requirement?

   • AUse a digital signature from the sensor's private key.
   • BAppend a cryptographic hash of the reading to the message and verify it on receipt.
   • CEncrypt the reading with a symmetric key before transmission.
   • DSend the reading twice and compare the two copies at the receiver.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to prioritize vulnerabilities found during an assessment?

   • ATo focus resources on the most critical risks first
   • BTo fix all vulnerabilities at once
   • CTo hide low-risk vulnerabilities
   • DTo increase the number of vulnerabilities
   Reveal Solution Discussion Select an answer first