Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A penetration tester is assessing a company's mobile app that is distributed only through the Apple App Store. The tester wants to identify vulnerabilities that could be exploited by a malicious app installed on the same device. Which approach is most appropriate?

   • AUse a network proxy to capture all HTTPS traffic from the app and analyze for weak TLS configurations.
   • BConduct dynamic analysis on a jailbroken device, intercepting traffic and monitoring for sensitive data leakage via inter-process communication (IPC).
   • CReview the app's entitlements and Info.plist for overly permissive App Transport Security (ATS) exceptions and URL scheme registrations that could be abused by another app.
   • DPerform static analysis of the app's IPA file using a tool like MobSF, focusing on insecure data storage and hardcoded secrets.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security consultant is performing a penetration test on a smart building's IoT lighting system. The devices communicate over Zigbee and have a local web interface for configuration. The consultant wants to enumerate the attack surface before attempting any exploit. Which action is the most appropriate first step?

   • AScan the local network for open ports on the web interface and identify the firmware version
   • BAttempt to log in with default credentials on the web interface
   • CDisassemble the device to locate the UART debug port
   • DIntercept Zigbee traffic with a sniffer to capture encryption keys
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Why do many OT environments rely on legacy systems that are difficult to secure?

   • AReplacing them would disrupt critical operations and require extensive downtime
   • BThey are immune to malware
   • CThey do not connect to any networks
   • DLegacy systems are inherently more secure
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is developing a mobile app for both iOS and Android. The security team wants to ensure that the app does not store sensitive data insecurely on the device. Which platform-specific feature should be used to securely store sensitive data?

   • AStore sensitive data in the app's internal storage directory.
   • BUse a third-party database with encryption enabled.
   • CUse the platform's secure storage APIs, such as Keychain on iOS and Keystore on Android.
   • DEncrypt sensitive data with a hardcoded key and store it in the app's preferences.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is an attack surface commonly found on IoT devices?

   • AFirmware update mechanism
   • BOperating system kernel
   • CSIM card
   • DCloud storage bucket
   Reveal Solution Discussion Select an answer first