Understand Common IoT Security and Privacy Countermeasures. ITP-110 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which measure is essential for securing IoT application APIs?

   • AUsing plaintext HTTP for simplicity
   • BAllowing all cross-origin requests
   • CUsing strong authentication and authorization for API requests
   • DDisabling all API logging
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which physical security control is designed to detect tampering with an IoT device?

   • ARate limiting
   • BEncryption
   • CFirewalls
   • DTamper-evident seals
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A manufacturer of industrial sensors needs to deploy a firmware update to devices in the field. The update fixes a critical security vulnerability, but the devices have limited flash storage and cannot hold both the old and new firmware simultaneously. The manufacturer must ensure that a failed update does not leave a device permanently bricked, and that the update cannot be rolled back to the vulnerable version by an attacker. Which update strategy best satisfies these constraints?

   • AUse a single partition and rely on the update server to re-send the firmware if the device fails to boot.
   • BStore the new firmware in a separate partition and require a manual factory reset to activate it.
   • CUse an A/B partition scheme with a bootloader that falls back to the last-known-good partition if the new firmware fails to boot.
   • DOverwrite the old firmware directly and rely on the update being signed and encrypted.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A regulatory body requires that a smart-grid operator be able to prove, at a later date, that a specific command to disconnect a substation was sent by an authorized operator and was not altered in transit. The operator currently uses a shared symmetric key for all communications. The regulator has rejected this approach because it cannot prove which operator sent the command. Which mechanism should the operator add to satisfy the nonrepudiation requirement?

   • AAdd a timestamp to the command and encrypt it with the shared key.
   • BHave each operator sign the command with their own private key using a digital signature.
   • CUse a stronger symmetric encryption algorithm for the command.
   • DLog the command in a centralized database with the operator's username.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is writing the firmware for a smart door lock that accepts unlock commands from a mobile app over the internet. The developer wants to prevent an attacker from sending a crafted command that causes the lock to malfunction or unlock unexpectedly. Which secure coding practice is most directly relevant to this threat?

   • AImplement a session timeout so that the mobile app must re-authenticate periodically.
   • BValidate and sanitize all input fields in the unlock command, including the command type and parameters.
   • CEncrypt all communication between the mobile app and the lock using TLS.
   • DLog all unlock commands to a central server for later analysis.
   Reveal Solution Discussion Select an answer first