Free Certified Internet of Things Security Practitioner™ Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Internet of Things Security Practitioner™ practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An IoT portal gives different login errors for an unknown username and a valid username with an incorrect password. What information can an attacker obtain from this difference?

   1. A. Which usernames belong to existing accounts
   2. B. Which roles permit device configuration changes
   3. C. Which passwords were reused on another website
   4. D. Which session tokens remain valid after logout

   Answer: A

   Explanation: "Incorrectly implemented error messages in the case of authentication functionality can be used for the purposes of user ID and password enumeration." The differing errors enable account enumeration. They do not disclose permissions, reused passwords, or session validity.

   Reference: OWASP Authentication Cheat Sheet — Authentication and Error Messages

2. 2An attacker tests username/password pairs stolen from a different website against an IoT account service. Which authentication attack is this?

   1. A. Credential stuffing
   2. B. Password spraying
   3. C. Session fixation
   4. D. Dictionary password guessing

   Answer: A

   Explanation: "Testing username/password pairs obtained from the breach of another site." Credential stuffing reuses breached username/password pairs. Spraying tests one password across accounts, fixation sets a session identifier, and dictionary guessing tries candidate passwords rather than the stolen pairs described.

   Reference: OWASP Authentication Cheat Sheet — Protect Against Automated Attacks — Credential Stuffing

3. 3A network-facing IoT service copies a received message into a fixed-size buffer without enforcing its capacity. An oversized message overwrites neighboring memory. Which vulnerability is demonstrated?

   1. A. Address spoofing
   2. B. Packet replay
   3. C. Buffer overflow
   4. D. DNS amplification

   Answer: C

   Explanation: "A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information." An input write exceeding the allocated buffer and overwriting other memory is a buffer overflow. Spoofing, replay and amplification concern different network mechanisms.

   Reference: NIST SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security — Appendix B, Glossary — buffer overflow

4. 4An IoT sensor sends confidential measurements as plaintext across a network an attacker can observe. Which security property is directly at risk from passive packet capture?

   1. A. Availability of measurements to legitimate recipients
   2. B. Authenticity of the measurement source's identity
   3. C. Confidentiality of the measurement contents in transit
   4. D. Integrity of the measurement values against alteration

   Answer: C

   Explanation: "Confidentiality: Provides protection against attackers reading the contents of the traffic." Passive packet capture of plaintext reveals contents, so confidentiality is directly lost. The described passive observation does not by itself alter values, impersonate the sender, or prevent delivery.

   Reference: OWASP Transport Layer Security Cheat Sheet — Introduction — security benefits

5. 5An IoT system securely processes accurate personal data using only authorized accounts, yet uses that data to influence individuals in ways they do not understand. What does NIST's privacy-risk model imply?

   1. A. Confidentiality controls eliminate privacy risk from authorized processing
   2. B. Authorized processing can cause privacy harms beyond a security breach
   3. C. Valid authorization makes every later processing purpose appropriate
   4. D. Accurate personal data cannot create adverse effects on individuals

   Answer: B

   Explanation: "These activities can be used to influence individuals’ behavior or decision-making in ways they do not understand" NIST identifies privacy effects from aggregation and analysis even when processing is authorized. Confidentiality, authorization and accuracy do not individually eliminate harmful processing effects.

   Reference: NIST IR 8228 — Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks — Section 3.1, Consideration 1, p. 6; Section 4.3, p. 23

6. 6An IoT device verifies vendor signatures but allows an unauthorized remote user to install an older, correctly signed image with a known vulnerability. Which threat remains?

   1. A. Forgery of a new signature on a modified firmware image
   2. B. Unauthorized rollback to an authentic but vulnerable firmware image
   3. C. Compromise of the manufacturer's private firmware-signing key
   4. D. Direct flash writes that bypass the normal update verifier

   Answer: B

   Explanation: "unauthorized rollback could allow an attacker to restore a vulnerable firmware image" A genuine signature does not prevent unauthorized installation of an older vulnerable release. This is rollback rather than signature forgery, signing-key theft or a direct flash-write bypass.

   Reference: NIST SP 800-193 — Platform Firmware Resiliency Guidelines — Section 4.2.1.3, Non-Bypassability

7. 7An attacker attaches a keystroke-logging peripheral to an exposed physical port on an IoT operator station. Which physical threat is illustrated?

   1. A. Input interception through an unsecured local port
   2. B. Offline extraction from a removed storage module
   3. C. Service disruption by disconnecting the power supply
   4. D. Hardware replacement inside the processor enclosure

   Answer: A

   Explanation: "Unsecured universal serial bus (USB) and PS/2 ports could allow unauthorized connection of thumb drives or keystroke loggers." The unsecured local port permits a keystroke logger to intercept input. No storage removal, power interruption or internal-board replacement is required.

   Reference: NIST SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security — Appendix C, Table 17, Unsecured physical ports, p. 177

8. 8An IoT reporting interface concatenates a search value into a database query. Crafted input changes the query's filtering logic. Which vulnerability does this demonstrate?

   1. A. Cross-site request forgery
   2. B. SQL injection
   3. C. Session fixation
   4. D. Insecure direct object reference

   Answer: B

   Explanation: "Injection flaws occur when an application sends untrusted data to an interpreter." Here the interpreter executes a SQL query whose structure is altered by input. This is query injection rather than request forgery, session binding, or an unchecked object identifier.

   Reference: OWASP Injection Prevention Cheat Sheet — Introduction; Forms of Injection — SQL injection

9. 9Authentication logs show the same commonly used password being tried once against each of hundreds of IoT user accounts. Which attack pattern does this indicate?

   1. A. Credential stuffing
   2. B. Password spraying
   3. C. Session fixation
   4. D. Session replay

   Answer: B

   Explanation: "Testing a single weak password against a large number of different accounts." The cross-account use of one password characterizes password spraying. It differs from breached-pair reuse and session-token attacks.

   Reference: OWASP Authentication Cheat Sheet — Protect Against Automated Attacks — Password Spraying

10. 10An IoT gateway receives many TCP SYN packets, but the senders do not finish the handshakes. Legitimate clients can no longer establish connections. Which resource is directly targeted by this attack?

    1. A. Application send buffers belonging to established TCP connections
    2. B. Cached mappings from local IP addresses to Ethernet MAC addresses
    3. C. Completed response data queued for delivery to the application
    4. D. Half-open TCP connection state awaiting handshake completion

    Answer: D

    Explanation: "The victim instantiates state to handle the incoming connections. If the attacker can instantiate state faster than the victim times it out, then the victim will run out of memory that it can use to hold TCP state" Unfinished connection setups consume TCP state. The RFC describes memory exhaustion for those attempts, rather than established application buffers, address-resolution entries or completed response data.

    Reference: RFC 4732 — Internet Denial-of-Service Considerations — Section 2.1.3, Operating System Resource Exhaustion