IoT Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are on an engagement where you have gained a root shell on an IoT device via a firmware backdoor. The device has two network interfaces: one on the IoT network (192.168.10.0/24) and one on the corporate network (10.0.0.0/24). The device's routing table only has a default route via the IoT network. You want to use the device as a pivot to scan the corporate network. Which of the following is the MOST effective approach?

   • AUse the device's existing default route to reach the corporate network by sending packets to the gateway.
   • BAdd a static route on the device for the 10.0.0.0/24 network via the corporate network interface, then use the device as a SOCKS proxy or use port forwarding to route traffic through it.
   • CDisable the default route on the IoT network interface to force traffic through the corporate network.
   • DRun a port scan directly from the device against the corporate network using the corporate interface's IP as the source.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are writing a penetration test report for an IoT device. You found that the device's firmware contains hardcoded credentials for a cloud API, and the device uses MQTT to communicate with the cloud. The client wants to know the most critical risk and the most effective mitigation. Which of the following would you include in the report?

   • AThe device's use of a cloud API is the most critical risk because it exposes the device to the internet. The most effective mitigation is to move the device to a local network.
   • BThe hardcoded credentials are the most critical risk because they allow an attacker to impersonate the device and access the cloud API. The most effective mitigation is to use a hardware security module (HSM) or secure element to store credentials and rotate them regularly.
   • CThe MQTT protocol is the most critical risk because it is unencrypted. The most effective mitigation is to enable TLS for MQTT.
   • DThe lack of firmware signing is the most critical risk because an attacker could modify the firmware. The most effective mitigation is to implement secure boot.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A tester is assessing a smart home system. The companion mobile app communicates with the cloud backend via HTTPS. The tester intercepts the traffic and notices that the app also sends device credentials in the URL query string. Which vulnerability is the tester most likely to report?

   • ASensitive information exposure in URLs
   • BInsecure storage of data on the device
   • CImproper session management
   • DWeak encryption algorithm
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A tester is assessing a smart home system. The mobile app has a feature to reset the device to factory defaults. The tester discovers that the reset process does not require authentication. Which vulnerability is this?

   • AInsecure storage of data
   • BInsecure direct object reference (IDOR)
   • CBroken access control
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A tester is evaluating a BLE-enabled fitness tracker. The tester wants to test for unauthorized access to the device's data. Which tool or technique is most appropriate for this task?

   • AUse a JTAG debugger to read the flash memory
   • BUse a BLE sniffer to capture and analyze advertising and connection packets
   • CUse a 433 MHz RF transceiver to intercept signals
   • DPerform a UART attack on the device
   Reveal Solution Discussion Select an answer first