IoT Architecture and Security Controls NDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a well-known IoT security standard that provides guidance on securing IoT devices and systems?

   • ANIST SP 800-183
   • BPCI DSS
   • CISO 9001
   • DITIL
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An industrial IoT deployment uses programmable logic controllers (PLCs) that are critical to production. The vendor releases a firmware update to fix a known vulnerability, but applying it requires a brief production shutdown. What should the team do?

   • AApply the update immediately without testing to close the vulnerability as fast as possible.
   • BSchedule the update during a planned maintenance window and test it in a staging environment first.
   • CSkip the update because the vulnerability is not likely to be exploited.
   • DApply the update only if the vendor guarantees no downtime.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company deploys IoT barcode scanners in a retail store. The scanners are connected to a local server that processes inventory data. The security team wants to protect the scanners from being compromised and used as a pivot point. Which combination of controls is most effective?

   • AConnect the scanners directly to the internet for remote management.
   • BUse a single shared password for all scanners to simplify management.
   • CSegment the scanners onto a separate VLAN, disable unnecessary services, and enforce strong authentication for the server.
   • DDisable firmware updates to prevent changes.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which security control is used to ensure that an IoT device only runs firmware that has been digitally signed by the manufacturer?

   • AStrong authentication
   • BNetwork segmentation
   • CData encryption
   • DSecure boot
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company deploys IoT devices that collect personal data. The company is subject to both GDPR and a sector-specific regulation that requires data to be stored within the country. The cloud provider offers regions in-country and abroad. Which approach is most compliant?

   • AAnonymize the data so it is no longer personal data.
   • BStore data on-premises only, avoiding the cloud entirely.
   • CUse the abroad region but encrypt all data.
   • DUse the in-country cloud region for storage and processing, and implement encryption and access controls.
   Reveal Solution Discussion Select an answer first