IoT Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is assessing a smart-building deployment. The system includes BLE-enabled door locks, a Zigbee mesh of environmental sensors, an MQTT broker on-premises, and a cloud-based management portal. The tester wants to identify the most likely entry point for an attacker who is not physically on-site. Which attack surface should be prioritized first?

   • AThe cloud management portal, because it is the only component that stores credentials
   • BThe BLE door locks, because BLE is always vulnerable to replay attacks
   • CThe Zigbee mesh, because it uses a low-power protocol that is inherently insecure
   • DThe MQTT broker, because it may be exposed to the internet or lack authentication
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A tester is assessing a wireless door lock that uses a 433 MHz RF remote. The tester captures a valid 'unlock' signal. The tester wants to demonstrate that an attacker can unlock the door without the original remote. Which attack should the tester perform?

   • AReplay the captured signal using a software-defined radio
   • BPerform a brute-force attack on the rolling code
   • CUse a BLE sniffer to capture the signal
   • DJam the 433 MHz frequency to block the signal
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of the JTAG interface in IoT hardware hacking?

   • ATo read sensor data
   • BTo supply power to the device
   • CTo connect the device to a Wi-Fi network
   • DTo provide a debugging and programming interface for the chip
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are planning a penetration test for a smart factory. The environment includes sensors, actuators, a local gateway, a cloud backend, and a mobile app for monitoring. The client wants you to focus on the attack surface that is most likely to be exposed to the internet. Which component should you prioritize?

   • AThe BLE communication between sensors and the gateway.
   • BThe local gateway's web interface.
   • CThe cloud backend and the mobile app's cloud APIs.
   • DThe sensors' firmware update mechanism.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a hardware assessment, you find a set of test points on the PCB that are labeled 'TMS', 'TCK', 'TDI', and 'TDO'. You suspect these are JTAG pins. What is the MOST likely benefit of connecting to these pins?

   • AYou can power the device directly through these pins.
   • BYou can sniff the SPI flash traffic to extract the firmware.
   • CYou can intercept UART communication between the main processor and the radio.
   • DYou can gain debug access to the CPU, which may allow you to read memory, modify registers, and potentially bypass secure boot.
   Reveal Solution Discussion Select an answer first