A city deploys smart meters that must operate for 10 years. The meters have limited storage and processing power. The security team must ensure that the meters can receive security updates without being physically accessed. Which approach is most appropriate?

Implement an over-the-air (OTA) update mechanism with signed firmware

Require physical access for every update

Use a single shared key for all meters to simplify updates

Disable updates to save battery life

A hospital deploys hundreds of IP cameras for patient monitoring. The cameras ship with a default admin account and several unused services enabled. The network team wants to reduce the attack surface before connecting them to the production network. Which two actions should the team take?

Enable all services for maximum functionality and rely on the network firewall for protection.

Disable unused services and change the default admin credentials on each camera.

Change the default credentials but leave unused services enabled for future use.

Disable unused services but keep the default admin account for remote troubleshooting.

A smart home company collects data from users' devices. To comply with privacy regulations, they must ensure that personal data is not exposed during transmission. Which measure should they implement?

Send data in plaintext to reduce latency

Rely on the ISP to secure the data

Use TLS for all data transmissions

Only use HTTPS for the website, not the devices

A company has a fleet of IoT devices that need regular security updates. They want to ensure that updates are authentic and have not been tampered with. Which measure should be implemented?

Use a shared password for all devices to simplify updates

Download updates from any website

Digitally sign the firmware updates and verify the signature before installation

Disable automatic updates to avoid interruptions

EC-CouncilIoT Security Essentials

Domain 4Objective 4

IoT Security Measures ISE Practice Questions (Page 2)

Part of the IoT Threats and Basic Security domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 6–10

6expert · hard
A city deploys smart meters that must operate for 10 years. The meters have limited storage and processing power. The security team must ensure that the meters can receive security updates without being physically accessed. Which approach is most appropriate?
Select an answer first
7foundation · easy
Which protocol is commonly used to secure IoT communication by providing encryption and authentication?
Select an answer first
8application · medium
A hospital deploys hundreds of IP cameras for patient monitoring. The cameras ship with a default admin account and several unused services enabled. The network team wants to reduce the attack surface before connecting them to the production network. Which two actions should the team take?
Select an answer first
9application · medium
A smart home company collects data from users' devices. To comply with privacy regulations, they must ensure that personal data is not exposed during transmission. Which measure should they implement?
Select an answer first
10application · medium
A company has a fleet of IoT devices that need regular security updates. They want to ensure that updates are authentic and have not been tampered with. Which measure should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.