Free Certified Internet of Things Security Practitioner Exam ITS-110 Exam Practice Test

A DevOps engineer wants to provide secure network services to an IoT/cloud solution. Which of the following countermeasures should be implemented to mitigate network attacks that can render a network useless?

• Network firewall
  
• Denial of Service (DoS)/Distributed Denial of Service (DDoS) mitigation
  
• Web application firewall (WAF)
  
• Deep Packet Inspection (DPI)
  

An embedded developer is about to release an IoT gateway. Which of the following precautions must be taken to minimize attacks due to physical access?

• Allow access only to the software
  
• Remove all unneeded physical ports
  
• Install a firewall on network ports
  
• Allow easy access to components
  

A site administrator is not enforcing strong passwords or password complexity. To which of the following types of attacks is this system probably MOST vulnerable?

• Key logger attack
  
• Dictionary attack
  
• Collision attack
  
• Phishing attack
  

Which of the following methods or technologies is most likely to be used to protect an IoT portal against protocol fuzzing?

• Secure Hypertext Transfer Protocol (HTTPS)
  
• Public Key Infrastructure (PKI)
  
• Next-Generation Firewall (NGFW)
  
• Hash-based Message Authentication Code (HMAC)
  

An IoT developer has endpoints that are shipped to users in the field. Which of the following best practices must be implemented for using default passwords after delivery?

• Implement two-factor authentication (2FA)
  
• Force a password change upon initial login
  
• Apply granular role-based access
  
• Protect against account enumeration
  

In order to successfully perform a man-in-the-middle (MITM) attack against a secure website, which of the following could be true?

• Client to server traffic must use Hypertext Transmission Protocol (HTTP)
  
• The server must be vulnerable to malformed Uniform Resource Locator (URL) injection
  
• The server must be using a deprecated version of Transport Layer Security (TLS)
  
• The web server's X.509 certificate must be compromised
  

In order to gain access to a user dashboard via an online portal, an end user must provide their username, a PIN, and a software token code. This process is known as:

• Type 1 authentication
  
• Type 2 authentication
  
• Two-factor authentication
  
• Biometric authentication
  

A hacker enters credentials into a web login page and observes the server's responses. Which of the following attacks is the hacker attempting?

• Account enumeration
  
• Directory traversal
  
• Buffer overflow
  
• Spear phishing
  

It is a new employee's first day on the job. When trying to access secured systems, he incorrectly enters his credentials multiple times. Which resulting action should take place?

• His account is deleted.
  
• He receives a new password.
  
• His account is locked.
  
• He notifies Human Resources.
  

A manufacturer wants to ensure that approved software is delivered securely and can be verified prior to installation on its IoT devices. Which of the following technologies allows the manufacturer to meet this requirement?

• Advanced Encryption Standard (AES)
  
• Public Key Infrastructure (PKI)
  
• Generic Routing Encapsulation (GRE)
  
• Internet Protocol Security (IPsec)