Endpoint Security IoT Devices CND Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company has deployed IoT sensors that normally send a small reading every 5 minutes. The security team wants to detect if a sensor is compromised and used as part of a botnet. Which monitoring approach would BEST detect this type of compromise?

   • ACheck the sensors' firmware version on a regular basis.
   • BMonitor the sensors' CPU and memory usage.
   • CMonitor the sensors' network traffic for unusual outbound connections or high data volumes.
   • DReview the sensors' physical location and access logs.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A hospital uses MQTT for its IoT medical device telemetry. The security team notices that the MQTT broker accepts connections without authentication and that all messages are transmitted in plaintext. Which combination of controls should be implemented to address these specific weaknesses?

   • AAdd a network-based intrusion detection system to monitor MQTT traffic.
   • BReplace MQTT with CoAP and enable DTLS.
   • CEnable TLS for MQTT and require client certificates or username/password authentication.
   • DMove the MQTT broker to a different VLAN and restrict access with firewall rules.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A hospital has a mix of IoT devices: infusion pumps that require low-latency communication with a central monitoring station, and smart TVs in patient rooms that are used for entertainment. The network team wants to segment the IoT devices to prevent lateral movement, but the infusion pumps must be able to communicate with the monitoring station without added latency. Which segmentation strategy best balances security and operational requirements?

   • AUse a single VLAN but enable port security to limit MAC addresses per port.
   • BPlace infusion pumps and smart TVs on separate VLANs, with the pumps' VLAN having a low-latency path to the monitoring station and the TVs' VLAN having no route to critical systems.
   • CPlace all IoT devices on a single VLAN to simplify management and reduce latency.
   • DPlace smart TVs on the same VLAN as the infusion pumps to reduce the number of VLANs.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A manufacturing company recently deployed hundreds of IP cameras and environmental sensors on the same flat network as its ERP servers and engineering workstations. The security team is concerned that a compromised IoT device could be used to pivot to critical systems. Which action should the team take FIRST to limit lateral movement?

   • AApply the latest firmware updates to all IoT devices.
   • BEnable logging on the IoT devices and forward logs to a central SIEM.
   • CPlace all IoT devices in a dedicated VLAN with firewall rules that block inbound traffic from the IoT segment to the corporate network.
   • DChange the default passwords on all IoT devices and disable any unused services.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team is configuring monitoring for a large IoT deployment. They want to detect a device that has been compromised and is scanning the internal network. The IoT devices normally communicate only with a central gateway. Which monitoring approach would BEST detect this behavior?

   • AMonitor the devices' physical location using GPS.
   • BMonitor for high CPU usage on the IoT devices.
   • CMonitor for outbound connections from IoT devices to internal IP addresses other than the gateway.
   • DMonitor for changes in the devices' firmware version.
   Reveal Solution Discussion Select an answer first