ITS-110 Exam Dumps - Certified Internet of Things Security Practitioner (CIoTSP)

Go to page:

Question # 9

A compromised IoT device is initiating random connections to an attacker's server in order to exfiltrate sensitive data. Which type of attack is being used?

Man-in-the-middle (MITM)

SSL session hijack

Reverse shell

Honeypot

Full Access

Question # 10

An IoT device has many sensors on it and that sensor data is sent to the cloud. An IoT security practitioner should be sure to do which of the following in regard to that sensor data?

Collect as much data as possible so as to maximize potential value of the new IoT use-case.

Collect only the minimum amount of data required to perform all the business functions.

The amount or type of data collected isn't important if you have a properly secured IoT device.

The amount or type of data collected isn't important if you implement proper authorization controls.

Full Access

Question # 11

An embedded developer is about to release an IoT gateway. Which of the following precautions must be taken to minimize attacks due to physical access?

Allow access only to the software

Remove all unneeded physical ports

Install a firewall on network ports

Allow easy access to components

Full Access

Question # 12

Requiring randomly generated tokens for each connection from an IoT device to the cloud can help mitigate which of the following types of attacks?

Malformed URL injection

Buffer overflow

SSL certificate hijacking

Session replay

Full Access

Question # 13

A hacker enters credentials into a web login page and observes the server's responses. Which of the following attacks is the hacker attempting?

Account enumeration

Directory traversal

Buffer overflow

Spear phishing

Full Access

Question # 14

A software developer for an IoT device company is creating software to enhance the capabilities of his company's security cameras. He wants the end users to be confidentthat the software they are downloading from his company's support site is legitimate. Which of the following tools or techniques should he utilize?

Data validation

Interrupt analyzer

Digital certificate

Pseudocode

Full Access

Question # 15

An IoT service collects massive amounts of data and the developer is encrypting the data, forcing administrative users to authenticate and be authorized. The data is being disposed of properly and on a timely basis. However, which of the following countermeasures is the developer most likely overlooking?

That private data can never be fully destroyed.

The best practice to only collect critical data and nothing more.

That data isn't valuable unless it's used as evidence for crime committed.

That data is only valuable as perceived by the beholder.

Full Access

Question # 16

A web administrator is concerned about injection attacks. Which of the following mitigation techniques should the web administrator implement?

Configure single sign-on (SSO)

Parameter validation

Require strong passwords

Require two-factor authentication (2FA)

Full Access