IoT Penetration Testing CPENT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During an IoT penetration test, you found that the MQTT broker uses no authentication and the companion mobile app stores the broker password in plaintext in its configuration file. Which of the following recommendations would you include in the report to address BOTH findings?

   • AChange the MQTT broker password to a longer, more complex value.
   • BRestrict MQTT broker access to specific IP addresses using a firewall.
   • CMove the MQTT broker to a different port to make it harder to find.
   • DEnable TLS for MQTT traffic and use client certificates for device and app authentication.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You have extracted a firmware image from an IoT device and mounted the filesystem. You find a script that contains a hardcoded password for a database. The database is on a remote server. What is the MOST appropriate way to validate this finding without causing damage?

   • AChange the password in the database to prevent unauthorized access.
   • BUse the password to access the database and extract all data to prove impact.
   • CImmediately report the hardcoded password to the client without testing it.
   • DAttempt to log in to the remote database using the hardcoded credentials from a safe testing environment.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You have gained a root shell on an IoT device via a firmware backdoor. The device is on a separate IoT network segment. Your goal is to pivot to the corporate network. Which of the following is the MOST appropriate first step?

   • AUpload a reverse shell to a public server to ensure you have a stable foothold.
   • BDisable the device's firewall to allow unrestricted traffic.
   • CImmediately run a port scan from the device against the entire corporate network range.
   • DEnumerate the network interfaces and routing table on the device to identify reachable networks and potential pivot points.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   You are testing a smart lock's companion mobile app. The app communicates with the lock via Bluetooth Low Energy (BLE) and also with a cloud backend. During testing, you intercept the BLE traffic and notice that the unlock command is sent without any encryption or authentication. What is the MOST direct impact you can demonstrate?

   • AExtract the firmware from the lock to find hardcoded credentials.
   • BUse a BLE jammer to prevent the app from communicating with the lock.
   • CPerform a man-in-the-middle attack on the cloud backend to steal user credentials.
   • DReplay the captured unlock command to unlock the door at a later time.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a key element of an IoT penetration testing report?

   • AThe testers' personal opinions about the device
   • BA list of all devices on the network
   • CA detailed guide on how to exploit the vulnerabilities
   • DA clear description of the vulnerabilities and their potential impact
   Reveal Solution Discussion Select an answer first