IoT Penetration Testing CPENT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A penetration tester is assessing a smart factory. The environment includes BLE-enabled sensors, a Zigbee mesh, and a central gateway that connects to the corporate network. The tester has physical access to one sensor and can capture BLE traffic. The goal is to gain access to the corporate network. The sensor does not have internet access, but the gateway does. Which approach is most effective?

   • AAttempt to brute-force the gateway's web interface
   • BCompromise the sensor via BLE, then pivot to the gateway
   • CReplay BLE commands to the sensor to cause a denial of service
   • DUse a Zigbee sniffer to capture traffic and replay it to the gateway
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A tester is assessing a smart home system. The companion mobile app has a feature to share device access with other users. The tester discovers that the app uses a predictable token for authorization. The tester wants to demonstrate that an attacker can gain unauthorized access to a victim's devices. Which attack is most appropriate?

   • AUse a BLE sniffer to capture the token
   • BExploit a buffer overflow in the app
   • CPerform a man-in-the-middle attack on the app's HTTPS traffic
   • DPredict or brute-force the token to access the victim's device list
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A penetration test of a medical IoT device reveals that the firmware contains hardcoded administrative credentials and that the debug UART port is enabled in production. Which recommendation should the tester prioritize in the report?

   • ARequire strong passwords for the admin account
   • BImplement network segmentation to isolate the device
   • CEncrypt all network traffic to the device
   • DRemove hardcoded credentials and disable debug interfaces in production
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary goal of post-exploitation in IoT penetration testing?

   • ATo patch the vulnerabilities found
   • BTo demonstrate the impact of the compromise and pivot to other systems
   • CTo document the attack surface
   • DTo destroy the device's firmware
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which tool is commonly used to extract a file system from a firmware image?

   • ANmap
   • Bbinwalk
   • CWireshark
   • DMetasploit
   Reveal Solution Discussion Select an answer first