IoT Device Security ECSS Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A security analyst notices that a smart thermostat on the corporate network is sending a large volume of encrypted traffic to an external IP address at 3:00 AM, a time when the building is unoccupied. The thermostat's normal behavior is to send small status updates every 15 minutes. What should the analyst do FIRST?

   • ABlock the external IP address in the firewall immediately.
   • BDisconnect the thermostat from the network and perform a factory reset.
   • CIgnore the traffic because the thermostat is designed to communicate with its vendor's cloud service.
   • DInvestigate the traffic pattern and correlate it with known threat intelligence and device logs.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company has deployed IoT sensors that use MQTT for communication. The sensors are configured with default credentials and communicate over an unencrypted channel. The company wants to improve security without replacing the sensors. What is the best approach?

   • ADeploy an intrusion detection system (IDS) to monitor the sensor traffic.
   • BPlace the sensors on a separate VLAN with no internet access.
   • CUse a VPN tunnel for all sensor traffic.
   • DChange the default credentials and enable TLS for MQTT communication.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Why is IoT device security considered a critical part of overall network defense?

   • ABecause IoT devices often lack robust built-in security and can serve as weak points for attackers to enter the network
   • BBecause IoT devices are immune to malware and do not require monitoring
   • CBecause IoT devices are typically isolated from the rest of the network and pose no risk
   • DBecause IoT devices are always the most powerful computers on the network
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has a large number of IoT devices that generate a high volume of network traffic. The security team wants to detect anomalies but has limited storage for logs. What is the best approach?

   • AUse flow-based monitoring that records metadata instead of full packet captures.
   • BStore logs only for devices that have had security incidents.
   • CCapture full packets for all traffic and store them for 90 days.
   • DDisable logging for IoT devices to save storage.
   Reveal Solution Discussion Select an answer first