Certified Internet of Things Security Practitioner

Question 1

A hacker is sniffing network traffic with plans to intercept user credentials and then use them to log into remote websites. Which of the following attacks could the hacker be attempting? (Choose two.)

A. Session replay

B. Masquerading

C. Directory traversal

D. Spear phishing

E. Brute force

Correct Answer: D,E

Question 2

Recently, you purchased a smart watch from Company A. You receive a notification on your watch that you missed a call and have a new message. Upon checking the message, you hear the following:
"Hello, my name is Julie Simmons, and I'm with Company A. I want to thank you for your recent purchase and send you a small token of our appreciation. Please call me back at 888-555-1234. You will need to enter your credit card number, so we can authenticate you and ship your gift. Thanks for being a valued customer and enjoy your gift!" Which of the following types of attacks could this be?

A. Whaling

B. Phishing

C. Vishing

D. Spear phishing

Correct Answer: D

Question 3

What is one popular network protocol that is usually enabled by default on home routers that creates a large attack surface?

A. Network Address Translation (NAT)

B. Universal Plug and Play (UPnP)

C. Open virtual private network (VPN)

D. Domain Name System Security Extensions (DNSSEC)

Correct Answer: B

Question 4

An IoT developer wants to ensure that their cloud management portal is protected against compromised end-user credentials. Which of the following technologies should the developer implement?

A. An authentication policy which requires two random tokens generated by a hardware device.

B. An authentication policy which requires user passwords to include twelve characters, including uppercase, lowercase, and special characters.

C. An authentication policy that requires a user to provide a strong password and on-demand token delivered via SMS.

D. An authentication policy that requires a password at initial logon, and a second password in order to access advanced features.

Correct Answer: C

Question 5

Web forms that contain unvalidated fields are vulnerable to which of the following attacks? (Choose two.)

A. SQL Injection (SQLi)

B. Cross-Site Scripting (XSS)

C. Man-in-the-middle (MITM)

D. Ping of death

E. Smurf

Correct Answer: A,B

Question 6

You made an online purchase of a smart watch from a software as a service (SaaS) vendor, and filled out an extensive profile that will help you track several fitness variables. The vendor will provide you with customized health insights based on your profile. With which of the following regulations should the company be compliant? (Choose three.)

A. Sarbanes-Oxley (SOX)

B. Health Insurance Portability and Accountability Act (HIPAA)

C. Federal Information Security Management Act (FISMA)

D. Federal Energy Regulatory Commission (FERC)

E. Family Educational Rights and Privacy Act (FERPA)

F. Gramm-Leach-Bliley Act (GLBA)

G. Payment Card Industry Data Security Standard (PCI-DSS)

Correct Answer: B,E,G

Question 7

An IoT software developer wants the users of her software tools to know if they have been modified by someone other than her. Which of the following tools or techniques should she use?

A. Encryption

B. Fuzzing

C. Hashing

D. Obfuscation

Correct Answer: C

Question 8

An embedded developer is about to release an IoT gateway. Which of the following precautions must be taken to minimize attacks due to physical access?

A. Install a firewall on network ports

B. Remove all unneeded physical ports

C. Allow access only to the software

D. Allow easy access to components

Correct Answer: B

CertNexus Certified Internet of Things Security Practitioner - ITS-110 Exam Practice Test

Latest Update

Useful Links

Contact Us