Understand Common IoT Security and Privacy Countermeasures. ITP-110 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is responsible for a large deployment of IoT devices across multiple sites. They have a limited budget and must prioritize which vulnerabilities to remediate first. A vulnerability scan has identified several issues: a critical remote code execution flaw in the firmware, a medium-severity issue with default credentials on a subset of devices, and a low-severity information disclosure in the web interface. The team cannot fix everything at once. Which prioritization approach is the most appropriate?

   • ADefer all remediation until a full penetration test is completed.
   • BRemediate the default credentials first because they affect multiple devices.
   • CRemediate the critical remote code execution flaw first, then address the default credentials, and finally the information disclosure.
   • DFix the low-severity information disclosure first because it is the easiest to address.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A wearable health monitor sends a patient's heart-rate data to a cloud server. The device has limited processing power and battery life. The data must be kept confidential while in transit, and the server must be able to verify that the data came from the specific device. Which combination of cryptographic mechanisms is most appropriate given the device's constraints?

   • AUse a symmetric key for encryption and a shared secret for authentication, with no digital signature.
   • BUse asymmetric encryption with the server's public key for all data, and rely on the encryption for authentication.
   • CUse a hash of the data for integrity and send it in plaintext over the network.
   • DUse a pre-shared symmetric key for encrypting the data and a device-specific digital signature for authentication.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which technique is used to anonymize IoT data by removing personally identifiable information (PII)?

   • ARate limiting
   • BHashing
   • CData masking
   • DEncryption
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which action is part of hardening an IoT operating system?

   • AEnabling all default accounts with default passwords
   • BAllowing unrestricted remote access
   • CInstalling every available software package
   • DDisabling unnecessary services and ports
   Reveal Solution Discussion Select an answer first
6. 35foundation · medium

   Which statement best describes the role of confidentiality in an IoT system?

   • AIt ensures that the sender of a message cannot deny having sent it.
   • BIt ensures that only authorized parties can read or access the data transmitted or stored by IoT devices.
   • CIt ensures that data remains unaltered during transmission between a sensor and a gateway.
   • DIt ensures that IoT devices and services remain operational and accessible to authorized users when needed.
   Reveal Solution Discussion Select an answer first