IoT Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In an IoT penetration test, what does 'pivoting' refer to?

   • AChanging the device's IP address
   • BSwitching between different RF frequencies
   • CRotating the device's antenna for better signal
   • DUsing a compromised device as a foothold to attack other systems
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   You are testing a smart home system that uses MQTT for device-to-cloud communication. The devices publish sensor data to a broker, and a mobile app subscribes to receive updates. During testing, you notice that the MQTT broker allows anonymous connections. Which of the following attacks would you prioritize to demonstrate the most significant security impact?

   • ASubscribe to all topics on the broker to read sensor data and potentially inject malicious messages to control devices.
   • BScan the broker for open ports to identify other services that might be vulnerable.
   • CLaunch a denial-of-service attack by flooding the broker with connection requests.
   • DPerform a brute-force attack on the broker's TLS certificate to decrypt all traffic.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are testing a wireless IoT device that uses a proprietary protocol at 915 MHz. You have a software-defined radio (SDR) and have captured a signal that appears to be a command. You want to determine if the protocol is susceptible to replay attacks. What is the FIRST step you should take?

   • ADecode the signal using a universal decoder to extract the raw data.
   • BAnalyze the captured signal to identify the modulation, encoding, and any dynamic fields such as timestamps or counters.
   • CReplay the captured signal immediately to see if the device responds.
   • DUse a spectrum analyzer to measure the signal's frequency and bandwidth.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a CPENT engagement, you are assessing a smart building controller. You have physical access to the device and have successfully extracted the firmware image from the flash chip using an SPI programmer. Your goal is to identify hardcoded credentials that may allow you to gain a foothold on the device's management interface. Which of the following is the MOST efficient next step?

   • AUse a JTAG debugger to attach to the CPU and dump the contents of RAM, hoping to find credentials in memory.
   • BUse a hex editor to manually search the raw firmware dump for ASCII strings containing 'user' and 'pass'.
   • CImmediately attempt to flash the firmware back to the device and observe the boot logs for credential prompts.
   • DRun binwalk with the -e flag to recursively extract the filesystem, then grep for strings like 'password', 'passwd', and 'admin' in configuration files and binaries.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A tester is assessing a smart building with multiple IoT devices. The tester has identified that the MQTT broker is exposed to the internet and allows anonymous access. The tester wants to demonstrate the impact of this vulnerability. Which action would best demonstrate the impact?

   • AAttempt to brute-force the broker's credentials
   • BPublish a malicious message to a topic to control a device
   • CSubscribe to all MQTT topics and extract sensitive data
   • DPerform a denial-of-service attack on the broker
   Reveal Solution Discussion Select an answer first