6.7 Secure and Monitor Internet of Things (IoT) (e.g., Configuration, Network Isolation, Firmware Updates, End of Life (EOL) Management) SSCP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A hospital has a mix of IoT infusion pumps, some of which are end-of-life. The pumps are critical for patient care and cannot be replaced immediately. The hospital's security team must balance patient safety with security. What is the most appropriate strategy?

   • AReplace all EOL pumps immediately, regardless of cost and disruption.
   • BApply unofficial patches from online forums to the EOL pumps.
   • CIsolate the EOL pumps on a separate network segment with strict access controls and monitor them for anomalous behavior.
   • DDisconnect the EOL pumps from the network and use them in standalone mode.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses IoT sensors to monitor environmental conditions in its data centers. The sensors are end-of-life and no longer receive firmware updates. The company is planning to replace them over the next year. What is the most important thing to do in the meantime?

   • AIsolate the sensors on a separate network segment and monitor them for signs of compromise.
   • BContinue using the sensors as-is because they have been reliable.
   • CApply firmware updates from the vendor's website even though the sensors are EOL.
   • DDisconnect the sensors from the network and use manual monitoring.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital uses IoT devices for patient monitoring. Some devices are end-of-life and have known vulnerabilities. The hospital cannot replace them immediately due to budget constraints. What is the most appropriate strategy to manage the risk?

   • AIsolate the EOL devices on a separate network and implement strict access controls, while planning for replacement.
   • BContinue using the devices as-is because they are critical for patient care.
   • CDisconnect the EOL devices from the network and use manual monitoring.
   • DApply unofficial patches to the EOL devices to fix the vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A manufacturing company uses programmable logic controllers (PLCs) that are not internet-facing but are on the same network as employee workstations. The vendor releases a firmware update that fixes a critical remote code execution vulnerability. What is the most secure way to apply the update?

   • ARely on the network segmentation to protect the PLCs and skip the firmware update until the next scheduled maintenance cycle.
   • BDownload the firmware from the vendor's website, verify its checksum, and apply it during a scheduled maintenance window after testing in a lab.
   • CApply the update immediately to all PLCs during production hours to minimize the window of exposure to the vulnerability.
   • DAsk the vendor to send the firmware on a USB drive and install it on each PLC without verifying the file's integrity.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A utility company has a large number of smart meters that are still supported but have a known vulnerability that the vendor has patched. The company is concerned about the risk of exploitation. What is the most effective way to address this?

   • AReplace all meters with newer models that do not have the vulnerability.
   • BIsolate the meters on a separate network segment to prevent exploitation.
   • CMonitor the meters for unusual activity and wait for the next scheduled maintenance window to apply the patch.
   • DApply the vendor's firmware patch to all affected meters as soon as possible, following a tested deployment plan.
   Reveal Solution Discussion Select an answer first