Endpoint Security IoT Devices CND Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A European company deploys IoT devices that collect personal data from employees. The company must ensure the devices comply with GDPR. Which practice is REQUIRED under GDPR for this IoT deployment?

   • AImplement appropriate technical and organizational measures to protect personal data, such as encryption and access controls.
   • BEnsure all IoT devices are connected to the internet for remote monitoring.
   • CStore all personal data on the IoT devices themselves.
   • DUse only open-source firmware on all IoT devices.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses Zigbee-based smart lighting in its office. The security team is concerned about attacks that could compromise the Zigbee network and then pivot to the corporate network. Which control is most effective to limit the impact of a Zigbee compromise?

   • ADisable Zigbee and use Wi-Fi instead.
   • BPlace the Zigbee coordinator on a separate VLAN and restrict its access to the corporate network.
   • CMonitor Zigbee traffic for unusual patterns.
   • DUse a stronger Zigbee encryption key.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A water treatment facility uses outdoor IoT sensors to monitor chlorine levels. The sensors are mounted on poles with accessible enclosures. A recent audit found that the enclosures can be opened without tools, exposing the circuit boards and debug ports. Which control is most directly needed to address this finding?

   • AInstall tamper-evident seals and lockable enclosures on the sensors.
   • BEnable encryption on the sensor's wireless communication.
   • CChange the default password on the sensor's web interface.
   • DDeploy an IDS to monitor the sensor network.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which IoT communication protocol is designed for constrained devices and uses a RESTful request-response model over UDP, making it suitable for low-power, lossy networks?

   • ACoAP
   • BBluetooth
   • CZigbee
   • DMQTT
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A global company deploys IoT sensors in multiple countries, including the EU. The sensors collect personal data. The company wants to comply with GDPR while also ensuring that data can be processed in a central data center located outside the EU. Which approach is most compliant?

   • AImplement appropriate safeguards for cross-border data transfers, such as Standard Contractual Clauses (SCCs) or an adequacy decision, and ensure a legal basis for processing.
   • BObtain explicit consent from every individual for every data transfer.
   • CStore all data locally in each EU country and never transfer it to the central data center.
   • DAnonymize all data before transferring it to the central data center.
   Reveal Solution Discussion Select an answer first