IoT Device Security ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is investigating a series of failed login attempts on a smart thermostat's web interface. The attempts come from multiple IP addresses and use common default passwords. What is the most likely attack vector?

   • AA firmware exploit targeting the thermostat's chipset.
   • BA denial-of-service attack flooding the thermostat with traffic.
   • CA brute-force attack targeting weak credentials.
   • DA man-in-the-middle attack intercepting the thermostat's traffic.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A property management company has smart door locks for its rental units. The locks are managed via a cloud service. The company wants to ensure that only authorized personnel can unlock doors and that all access is logged. Which practice is most important?

   • ARely on the lock's physical key override as a backup.
   • BUse a shared admin account for all property managers to simplify access.
   • CDisable the cloud service and manage locks locally via Bluetooth.
   • DEnable multi-factor authentication (MFA) for the cloud management portal.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst notices that a smart thermostat in the office is sending a large amount of data to an external IP address that is not the vendor's cloud service. The thermostat has been functioning normally. What is the most likely attack vector and the best immediate response?

   • AThe thermostat is being used for DDoS; update its firmware.
   • BThe thermostat is malfunctioning; reboot it and monitor.
   • CThe thermostat is sending telemetry to a CDN; allow the traffic.
   • DThe thermostat is part of a botnet; isolate it from the network and investigate.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A smart building operator wants to secure IoT devices that control HVAC and lighting. The devices are from different vendors and use various protocols. The operator has a limited budget and wants to implement a security control that provides the broadest coverage across all devices. Which control should be prioritized?

   • AFocus on physical security of the devices only.
   • BReplace all devices with a single-vendor solution that has built-in security.
   • CImplement network segmentation and monitor traffic between segments.
   • DEnable all available security features on each device individually.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is an example of insecure communication in IoT devices?

   • AEncrypting data with TLS before transmission
   • BRequiring a strong password for device access
   • CUsing a firewall to filter incoming traffic
   • DSending data over the network without encryption, such as using plain HTTP instead of HTTPS
   Reveal Solution Discussion Select an answer first