IoT Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A tester has a smart plug that uses an SPI flash chip to store configuration data. The tester wants to extract the firmware and configuration without desoldering the chip. Which approach is most appropriate?

   • AUse a UART connection to dump the flash
   • BUse a JTAG debugger to read the flash
   • CUse a BLE sniffer to capture the data
   • DUse a clip to connect to the SPI flash chip while it is still on the PCB
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of extracting firmware from an IoT device during a penetration test?

   • ATo analyze the firmware for hardcoded credentials and vulnerabilities
   • BTo verify the device's compliance with standards
   • CTo improve the device's performance
   • DTo replace the firmware with a custom version
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are testing a smart thermostat's companion mobile app. The app allows users to control the thermostat remotely via a cloud API. During testing, you find that the API endpoint for changing the temperature does not check if the user is authorized to control that specific thermostat. What is the MOST likely vulnerability?

   • AInsecure direct object reference (IDOR) — but this is a different name for the same issue.
   • BCross-Site Scripting (XSS) in the mobile app's web view.
   • CBroken Object Level Authorization (BOLA) — the API fails to verify that the user owns the thermostat.
   • DSQL injection in the API endpoint.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A tester is assessing a wireless sensor network that uses Zigbee. The tester wants to test for unauthorized control of the devices. Which attack is most relevant?

   • AUse a 433 MHz RF jammer
   • BPerform a BLE man-in-the-middle attack
   • CReplay captured Zigbee frames
   • DExploit a UART port on the sensor
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After compromising a smart lighting hub, a tester wants to pivot to the corporate network. The hub is connected to a separate IoT VLAN that has a firewall rule allowing only MQTT traffic to the broker. Which technique would be most effective for the tester to establish a foothold on the corporate network?

   • AUse ARP spoofing to redirect traffic
   • BUse the MQTT broker as a jump host to reach other systems
   • CScan the corporate network directly from the hub
   • DDisable the firewall to allow all traffic
   Reveal Solution Discussion Select an answer first