IoT Device Security ECSS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a large number of IoT devices that are managed by different departments. The security team wants to implement a consistent security policy across all devices, but some departments resist changes that might affect device functionality. Which approach is MOST likely to succeed?

   • AMandate the policy without consulting departments to ensure compliance.
   • BApply the policy only to new devices, not existing ones.
   • CAllow each department to set its own security standards.
   • DInvolve all stakeholders in developing the policy and provide training on the importance of IoT security.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A facility manager wants to secure a building's access control system, which uses IoT-enabled card readers. The readers are connected to a central server via the network. The manager is concerned about unauthorized physical access if a reader is compromised. Which best practice should be implemented to mitigate this risk?

   • AUse the same password for all card readers to simplify management.
   • BUse strong, unique credentials for each card reader and disable default accounts.
   • CAllow the card readers to be accessed from any network location for convenience.
   • DDisable all logging on the card readers to save storage space.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is monitoring a smart building's IoT network. The analyst notices that a smart thermostat is sending data to a new IP address that is not in the allowlist. The thermostat's behavior is otherwise normal. What is the best action?

   • AInvestigate the new IP address and determine if it is legitimate before taking action.
   • BIgnore the alert because the thermostat is functioning normally.
   • CImmediately block the new IP address at the firewall.
   • DDisconnect the thermostat from the network.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A hospital uses IoT infusion pumps that are critical for patient care. The pumps run on a legacy operating system with known vulnerabilities and cannot be patched without vendor approval. The network team has been asked to reduce the risk of a firmware exploit while maintaining the pumps' availability and functionality. Which approach BEST balances security and operational requirements?

   • ASegment the pumps onto a dedicated network with strict access controls and monitor for anomalous traffic.
   • BAllow the pumps to communicate freely with other network devices to ensure functionality.
   • CReplace all pumps with newer models that have patched firmware.
   • DImmediately disconnect the pumps from the network until the vendor provides a patch.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a firmware exploit in the context of IoT attacks?

   • AAn attack that floods the device with network traffic to cause a denial of service
   • BA social engineering technique that tricks users into revealing their passwords
   • CA method to physically damage the device by applying excessive voltage
   • DAn attack that targets vulnerabilities in the device's low-level software to gain control or alter its behavior
   Reveal Solution Discussion Select an answer first