IoT Attacks and Methodology CEH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is conducting a penetration test on a smart building. The team has discovered a smart thermostat that is vulnerable to command injection. The thermostat is on a separate VLAN from the main network. What is the most efficient way to use this vulnerability to reach the main network?

   • APerform a physical attack on the thermostat to access the main network.
   • BUse social engineering to trick an employee into connecting the thermostat to the main network.
   • CUse a vulnerability scanner to directly scan the main network from the thermostat's VLAN.
   • DExploit the command injection to gain a shell on the thermostat, then use it as a pivot to scan and attack the main network.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network administrator suspects there are rogue IoT devices on the corporate network. The administrator wants to discover them without installing agents on every device. Which technique is most effective for this task?

   • ACheck the DHCP server logs for unknown MAC addresses.
   • BUse a packet sniffer to capture all traffic and manually review every packet for device identifiers.
   • CUse Nmap to scan the entire subnet for open ports and then fingerprint the devices using banner grabbing and OS detection.
   • DUse a vulnerability scanner to exploit known CVEs on every IP address.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is conducting a red-team exercise against a smart factory. The team has limited time and must compromise a specific PLC on the OT network. The PLC is not directly accessible from the IT network, but there is a smart sensor on the IT network that has a known vulnerability. What is the most efficient attack path?

   • ADirectly scan the OT network from the IT network to find the PLC.
   • BPerform a physical attack on the PLC's debug port.
   • CUse a social engineering attack on the factory's IT administrator to gain credentials.
   • DExploit the smart sensor, use it as a pivot to reach the OT network, then scan for the PLC and exploit it.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which exploitation technique involves sending more data to a buffer than it can hold, potentially overwriting adjacent memory and executing arbitrary code?

   • ASQL injection
   • BAuthentication bypass
   • CBuffer overflow
   • DCommand injection
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester is assessing a smart vending machine that accepts contactless payments. The machine has an NFC reader, a cellular modem, and a touchscreen. The tester wants to test an attack vector that could be exploited without opening the device or connecting to its wired network. Which vector should the tester attempt first?

   • AConnecting to the UART debug port to gain a shell
   • BReplacing the firmware chip with a malicious one
   • CSniffing traffic on the wired Ethernet port
   • DIntercepting and replaying NFC payment transactions
   Reveal Solution Discussion Select an answer first