IoT Attacks and Methodology CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester has extracted the firmware of an IoT router and found that the web interface uses a hardcoded encryption key to encrypt session cookies. The tester wants to forge a valid admin session cookie. Which exploitation technique is most appropriate?

   • APerform a brute-force attack on the admin password.
   • BPerform a buffer overflow on the web server to gain a shell.
   • CUse the hardcoded key to forge a cookie with the admin role and replay it to the web interface.
   • DUse a command injection in the router's ping utility to execute commands.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester extracted a firmware image from a smart camera and wants to find hardcoded credentials and insecure configuration files. Which tool or technique is most appropriate for this task?

   • AUse a JTAG debugger to read the flash memory directly from the device.
   • BRun the firmware in an emulator and attempt to exploit a known buffer overflow in the web server.
   • CUse Binwalk to extract the filesystem, then grep for strings like 'password', 'passwd', and 'root' in configuration files.
   • DUse Wireshark to capture network traffic from the camera and look for plaintext credentials.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which IoT attack vector is characterized by exploiting vulnerabilities in the device's software that controls its basic operations?

   • ANetwork attack
   • BSocial engineering attack
   • CFirmware attack
   • DPhysical attack
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is performing a risk assessment of a smart building deployment. The building uses IP cameras, smart locks, and environmental sensors, all connected to a central management server. The analyst wants to identify the attack surface that would be most exposed to an external attacker without physical access. Which component should be prioritized?

   • AThe network services exposed by the devices, such as open ports and web interfaces
   • BThe device enclosures and tamper-resistant seals
   • CThe local storage chips used for device configuration
   • DThe physical debug ports (e.g., UART, JTAG) on the device circuit boards
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After compromising a smart lighting hub, a penetration tester wants to maintain access even after the device reboots. Which post-exploitation technique is most appropriate for persistence?

   • AOpen a reverse shell to the tester's server and keep the connection alive.
   • BChange the device's default password to a known value.
   • CDisable the device's logging to hide future activity.
   • DInstall a modified firmware image that includes a backdoor and survives reboot.
   Reveal Solution Discussion Select an answer first