IoT Architecture and Security Controls NDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A medical device manufacturer sells IoT wearables that collect health data from patients in the EU. The company must comply with GDPR and is also considering the OWASP IoT Top 10 for security guidance. The product team wants to minimize the risk of data breaches while meeting regulatory requirements. Which approach best aligns with both GDPR and OWASP IoT Top 10?

   • AImplement data minimization by collecting only necessary health data, and apply strong encryption for data at rest and in transit.
   • BDisable encryption to improve device performance, since GDPR does not explicitly require encryption.
   • CRely solely on the cloud provider's security certifications to ensure compliance.
   • DStore all health data in a public cloud region outside the EU to avoid GDPR restrictions.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In IoT threat modeling, which of the following is considered an attack surface?

   • AThe device's physical ports
   • BThe device's brand name
   • CThe device's color
   • DThe device's weight
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A smart factory uses sensors to monitor machine vibration. The data is sent to a local gateway, which forwards it to a cloud analytics platform. The factory network team wants to apply security controls at each layer. Which control is most appropriate for the network layer?

   • ADeploy an intrusion detection system (IDS) on the network segment between the gateway and the cloud.
   • BImplement secure boot on the sensors.
   • CEncrypt the data at rest in the cloud database.
   • DUse strong authentication for the cloud dashboard.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security architect is threat-modeling an IoT deployment that includes edge devices, a local gateway, and a cloud backend. The team must prioritize which attack surface to address first given limited budget. Which approach best aligns with a structured threat-modeling methodology?

   • AStart by mapping data flows and trust boundaries across device, network, and cloud, then identify threats at each boundary.
   • BApply the same security controls to every component regardless of risk.
   • CDeploy a firewall at the network perimeter and consider the threat model complete.
   • DFocus exclusively on the cloud backend because it holds the most sensitive data.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which data protection measure ensures that IoT data stored on a device or in the cloud is unreadable if the storage medium is physically stolen?

   • AEncryption in transit
   • BEncryption at rest
   • CData minimization
   • DData masking
   Reveal Solution Discussion Select an answer first