Weekend Sale Special Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

CertNexus ITS-110 Certified Internet of Things Security Practitioner (CIoTSP) Exam Practice Test

Page: 1 / 10
Total 100 questions

Certified Internet of Things Security Practitioner (CIoTSP) Questions and Answers

Question 1

Which of the following attacks is a reflected Distributed Denial of Service (DDoS) attack?

Options:

A.

Teardrop

B.

Ping of Death

C.

SYN flood

D.

Smurf

Question 2

Which of the following is one way to implement countermeasures on an IoT gateway to ensure physical security?

Options:

A.

Add tamper detection to the enclosure

B.

Limit physical access to ports when possible

C.

Allow quick administrator access for mitigation

D.

Implement features in software instead of hardware

Question 3

An IoT manufacturer wants to ensure that their web-enabled cameras are secured against brute force password attacks. Which of the following technologies or protocols could they implement?

Options:

A.

URL filtering policies

B.

Account lockout policies

C.

Software encryption

D.

Buffer overflow prevention

Question 4

You work for an IoT software-as-a-service (SaaS) provider. Your boss has asked you to research a way to effectively dispose of stored sensitive customer data. Which of the following methods should you recommend to your boss?

Options:

A.

Crypto-shredding

B.

Degaussing

C.

Overwriting

D.

Physical destruction

Question 5

Passwords should be stored…

Options:

A.

For no more than 30 days.

B.

Only in cleartext.

C.

As a hash value.

D.

Inside a digital certificate.

Question 6

You made an online purchase of a smart watch from a software as a service (SaaS) vendor, and filled out an extensive profile that will help you track several fitness variables. The vendor will provide you with customized health insights based on your profile. With which of the following regulations should the company be compliant? (Choose three.)

Options:

A.

Gramm-Leach-Bliley Act (GLBA)

B.

Payment Card Industry Data Security Standard (PCI-DSS)

C.

Federal Information Security Management Act (FISMA)

D.

Sarbanes-Oxley (SOX)

E.

Health Insurance Portability and Accountability Act (HIPAA)

F.

Family Educational Rights and Privacy Act (FERPA)

G.

Federal Energy Regulatory Commission (FERC)

Question 7

A hacker enters credentials into a web login page and observes the server's responses. Which of the following attacks is the hacker attempting?

Options:

A.

Account enumeration

B.

Directory traversal

C.

Buffer overflow

D.

Spear phishing

Question 8

Network filters based on Ethernet burned-in-addresses are vulnerable to which of the following attacks?

Options:

A.

Media Access Control (MAC) spoofing

B.

Buffer overflow

C.

Packet injection

D.

GPS spoofing

Question 9

A web application is connected to an IoT endpoint. A hacker wants to steal data from the connection between them. Which of the following is NOT a method of attack that could be used to facilitate stealing data?

Options:

A.

Cross-Site Request Forgery (CSRF)

B.

SQL Injection (SQLi)

C.

Cross-Site Scripting (XSS)

D.

LDAP Injection

Question 10

If an attacker were able to gain access to a user's machine on your network, which of the following actions would she most likely take next?

Options:

A.

Start log scrubbing

B.

Escalate privileges

C.

Perform port scanning

D.

Initiate reconnaissance

Question 11

A security practitioner wants to encrypt a large datastore. Which of the following is the BEST choice to implement?

Options:

A.

Asymmetric encryption standards

B.

Symmetric encryption standards

C.

Elliptic curve cryptography (ECC)

D.

Diffie-Hellman (DH) algorithm

Question 12

An IoT gateway will be brokering data on numerous northbound and southbound interfaces. A security practitioner has the data encrypted while stored on the gateway and encrypted while transmitted across the network. Should this person be concerned with privacy while the data is in use?

Options:

A.

Yes, because the hash wouldn't protect the integrity of the data.

B.

Yes, because the data is vulnerable during processing.

C.

No, since the data is already encrypted while at rest and while in motion.

D.

No, because the data is inside the CPU's secure region while being used.

Question 13

An IoT system administrator discovers that unauthorized users are able to log onto and access data on remote IoT monitoring devices. What should the system administrator do on the remote devices in order to address this issue?

Options:

A.

Encrypt all locally stored data

B.

Ensure all firmware updates have been applied

C.

Change default passwords

D.

Implement URL filtering

Question 14

Which of the following functions can be added to the authorization component of AAA to enable the principal of least privilege with flexibility?

Options:

A.

Discretionary access control (DAC)

B.

Role-based access control (RBAC)

C.

Mandatory access control (MAC)

D.

Access control list (ACL)

Question 15

Web forms that contain unvalidated fields are vulnerable to which of the following attacks? (Choose two.)

Options:

A.

Smurf

B.

Ping of death

C.

Cross-Site Scripting (XSS)

D.

Man-in-the-middle (MITM)

E.

SQL Injection (SQLi)

Question 16

A software developer for an IoT device company is creating software to enhance the capabilities of his company's security cameras. He wants the end users to be confidentthat the software they are downloading from his company's support site is legitimate. Which of the following tools or techniques should he utilize?

Options:

A.

Data validation

B.

Interrupt analyzer

C.

Digital certificate

D.

Pseudocode

Question 17

Which of the following methods is an IoT portal administrator most likely to use in order to mitigate Distributed Denial of Service (DDoS) attacks?

Options:

A.

Implement Domain Name System Security Extensions (DNSSEC) on all Internet-facing name servers

B.

Disable Network Address Translation Traversal (NAT-T) at the border firewall

C.

Implement traffic scrubbers on the upstream Internet Service Provider (ISP) connection

D.

Require Internet Protocol Security (IPSec) for all inbound portal connections

Question 18

An IoT integrator wants to deploy an IoT gateway at the Edge and have it connect to the cloud via API. In order to minimize risk, which of the following actions should the integrator take before integration?

Options:

A.

Write down the default login and password

B.

Remove all logins and passwords that may exist

C.

Create new credentials using a strong password

D.

Reset the IoT gateway to factory defaults

Question 19

A hacker wants to record a live session between a user and a host in hopes that parts of the datastream can be used to spoof the session. Which of the following attacks is this person attempting?

Options:

A.

Fuzzing

B.

Session replay

C.

Bit flipping

D.

Reverse shell

Question 20

Which of the following tools or techniques is used by software developers to maintain code, but also used by hackers to maintain control of a compromised system?

Options:

A.

Disassembler

B.

Backdoor

C.

Debugger

D.

Stack pointer

Question 21

An IoT security architect needs to secure data in motion. Which of the following is a common vulnerability used to exploit unsecure data in motion?

Options:

A.

External flash access

B.

Misconfigured Secure Sockets Layer (SSL)/Transport Layer Security (TLS)

C.

Databases and datastores

D.

Lack of memory space isolation

Question 22

An IoT security architect needs to minimize the security risk of a radio frequency (RF) mesh application. Which of the following might the architect consider as part of the design?

Options:

A.

Make pairing between nodes very easy so that troubleshooting is reduced.

B.

Encrypt data transmission between nodes at the physical/logical layers.

C.

Prevent nodes from being rejected to keep the value of the network as high as possible.

D.

Allow implicit trust of all gateways since they are the link to the internet.

Question 23

You work for a multi-national IoT device vendor. Your European customers are complaining about their inability to access the personal information about them that you have collected. Which of the following regulations is your organization at risk of violating?

Options:

A.

Sarbanes-Oxley (SOX)

B.

General Data Protection Regulation (GDPR)

C.

Electronic Identification Authentication and Trust Services (elDAS)

D.

Database Service on Alternative Methods (DB-ALM)

Question 24

An IoT software developer strives to reduce the complexity of his code to allow for efficient design and implementation. Which of the following terms describes the design principle he is implementing?

Options:

A.

Calibration

B.

Demodulation

C.

Encapsulation

D.

Abstraction

Question 25

A developer needs to implement a highly secure authentication method for an IoT web portal. Which of the following authentication methods offers the highest level of identity assurance for end users?

Options:

A.

A hardware-based token generation device

B.

An X.509 certificate stored on a smart card

C.

Two-step authentication with complex passwords

D.

Multi-factor authentication with three factors

Question 26

Which of the following methods or technologies is most likely to be used in order to mitigate brute force attacks?

Options:

A.

Account lockout policy

B.

Automated security logging

C.

Role-based access control

D.

Secure password recovery

Question 27

An OT security practitioner wants to implement two-factor authentication (2FA). Which of the following is the least secure method to use for implementation?

Options:

A.

Out-of-band authentication (OOBA)

B.

2FA over Short Message Service (SMS)

C.

Authenticator Apps for smartphones

D.

Fast Identity Online (FIDO) Universal 2nd Factor (U2F) USB key

Question 28

An IoT systems administrator needs to be able to detect packet injection attacks. Which of the follow methods or technologies is the administrator most likely to implement?

Options:

A.

Internet Protocol Security (IPSec) with Encapsulating Security Payload (ESP)

B.

Point-to-Point Tunneling Protocol (PPTP)

C.

Layer 2 Tunneling Protocol (L2TP)

D.

Internet Protocol Security (IPSec) with Authentication Headers (AH)

Question 29

Which of the following attacks would most likely be used to discover users, printers, and other objects within a network?

Options:

A.

Distributed Denial of Service (DDoS)

B.

SYN flood

C.

LDAP Injection

D.

Denial of Service (DoS)

Question 30

A hacker is sniffing network traffic with plans to intercept user credentials and then use them to log into remote websites. Which of the following attacks could the hacker be attempting? (Choose two.)

Options:

A.

Masquerading

B.

Brute force

C.

Directory traversal

D.

Session replay

E.

Spear phishing

Page: 1 / 10
Total 100 questions