Edge Identity and Authentication GCSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company produces edge devices that run a custom Linux distribution. The security team wants to ensure that only approved software components are included in the device image and that the image has not been altered between build and deployment. Which supply chain security control should they implement?

   • AScan the image for known vulnerabilities before deployment.
   • BSign the device image with a private key and verify the signature on the device before boot.
   • CStore the image in a private container registry.
   • DUse a software bill of materials (SBOM) to list all components.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is deploying edge devices that process data locally and occasionally sync with the cloud. The devices need to authenticate to the cloud without relying on a stable internet connection. Which edge identity model best supports this intermittent connectivity?

   • AUse OAuth tokens that are refreshed only when the device is online.
   • BUse long-lived certificates that never expire.
   • CUse short-lived certificates that are renewed whenever the device has connectivity.
   • DUse a shared secret that is pre-provisioned on all devices.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An energy company is deploying firmware updates to thousands of remote sensors. The sensors have limited compute power and cannot perform heavy cryptographic operations. The security team wants to ensure that only authentic firmware from the vendor is installed, and that the firmware has not been tampered with during transit. Which approach provides the strongest integrity and authenticity verification while respecting the sensors' constraints?

   • AVerify a digital signature over the firmware using a public key embedded in the sensor's read-only memory.
   • BRely on the integrity of the HTTPS connection to the vendor's download server.
   • CUse a pre-shared key to encrypt the firmware and decrypt it on the sensor.
   • DCompare a SHA-256 hash of the downloaded firmware against a hash published on the vendor's website.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which practice is considered a best practice for storing secrets at the edge?

   • AStoring secrets in a dedicated secrets management service with encryption and access controls
   • BStoring secrets in plain text configuration files that are mounted at runtime
   • CHardcoding secrets in application source code for simplicity
   • DEmbedding secrets directly in container images for easy deployment
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A smart-city project deploys cameras and sensors that publish data to a message broker. The broker must authenticate each publisher and ensure that messages are not altered in transit. The devices are resource-constrained and cannot maintain long-lived TLS sessions. Which authentication mechanism is most appropriate for this edge-to-broker communication?

   • AUse mutual TLS with client certificates for each device.
   • BUse OAuth 2.0 client credentials to obtain an access token and include it in each message.
   • CUse pre-shared keys (PSK) with TLS to authenticate each device.
   • DUse JSON Web Tokens (JWTs) in each message without TLS.
   Reveal Solution Discussion Select an answer first