IoT Device Security ECSS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A hospital has a mix of legacy and modern IoT medical devices. The legacy devices cannot be patched and use unencrypted protocols. The hospital must maintain device functionality and comply with patient safety regulations. What is the best approach to secure these devices?

   • ADisconnect the legacy devices from the network and use manual data collection.
   • BReplace all legacy devices with modern, secure equivalents.
   • CApply virtual patches via an intrusion prevention system (IPS) inline.
   • DSegment the legacy devices onto a separate network and use a gateway to filter traffic.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A small retail store uses smart locks, IP cameras, and a cloud-based inventory sensor system. The store owner wants to improve IoT security without hiring additional IT staff. Which practice is the most effective first step?

   • AReplace all IoT devices with newer models that have built-in security features.
   • BChange all default credentials and enable two-factor authentication where supported.
   • CDeploy an intrusion prevention system (IPS) inline with the IoT network.
   • DPlace all IoT devices on a separate VLAN with no internet access.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has IoT devices that are part of a botnet. The devices are sending spam emails and participating in DDoS attacks. The security team wants to remediate the issue without causing a prolonged outage for the devices' legitimate functions. Which approach is MOST appropriate?

   • ADisconnect the devices from the network permanently.
   • BIgnore the botnet activity because the devices are still functioning normally.
   • COnly block the specific ports used for DDoS attacks.
   • DIsolate the affected devices, clean them, and apply security updates before reconnecting.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is deploying IoT devices that collect sensitive data. The data is transmitted to a cloud server for analysis. The company wants to ensure that the data is protected both in transit and at rest. Which combination of controls should be implemented?

   • AUse a VPN for all communications and rely on the cloud provider's security for data at rest.
   • BUse a proprietary protocol that is not publicly documented.
   • CUse only physical security controls for the devices.
   • DUse TLS for data in transit and encryption for data at rest.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital uses a mix of IoT devices, including infusion pumps, patient monitors, and environmental sensors. The network team wants to detect a compromised device that is attempting to communicate with a known command-and-control server. Which monitoring approach would be MOST effective for this goal?

   • AMonitor the devices' CPU and memory usage on the management console.
   • BMonitor the battery levels of battery-powered devices.
   • CMonitor network traffic for connections to known malicious IP addresses and domains.
   • DMonitor the physical location of each device using RFID tags.
   Reveal Solution Discussion Select an answer first