Certified Internet of Things Security Practitioner Free Sample Questions

Protocol for Carrying Authentication for Network Access (PANA) is a network-layer protocol specifically designed for network access authentication in IP-based networks, making it suitable for 6LoWPAN. It works with the Extensible Authentication Protocol (EAP) to provide robust authentication before a device is granted full network access. IPsec is too heavyweight for many constrained 6LoWPAN devices. MAC filtering is easily spoofed and not scalable. DTLS operates at the transport layer, not the network layer for initial access control.

For handling sensitive Protected Health Information (PHI) under HIPAA, the highest level of security is required. BLE Security Mode 1, Level 4 mandates the use of LE Secure Connections, which uses Elliptic Curve Diffie-Hellman (ECDH) key exchange for strong encryption and protects against passive eavesdropping and man-in-the-middle attacks. The lower security levels (1, 2, and 3) are not sufficient for protecting sensitive medical data.

Digital signatures provide authenticity (proving the firmware came from the manufacturer) and integrity (ensuring it wasn't altered).

Secure boot ensures that the PLC will only load and execute firmware that has been cryptographically verified (e.g., by checking the digital signature), thus preventing unauthorized code from running.

Constrained Application Protocol (CoAP) is designed for constrained devices and networks, running over UDP. Datagram Transport Layer Security (DTLS) provides security equivalent to TLS but is adapted for datagram-based protocols like UDP, making it ideal for low-power, lossy networks. This combination is energy-efficient and provides strong security. TLS over TCP, IPsec, and SSH are all too resource-intensive for this use case.

The statement is false. Privacy by Design is a core principle that dictates privacy should be embedded into the design and architecture of IT systems and business practices from the very beginning of the development lifecycle, not added as an afterthought. It emphasizes proactive rather than reactive measures.

The most direct and effective countermeasure against attacks via debug ports is to disable them completely in the final production version of the firmware. This is often done by blowing an eFuse on the microcontroller, making the change irreversible. While encryption is important, an attacker with debug access could potentially bypass it. Tamper-evident seals detect attacks but don't prevent them, and network access control is irrelevant to this physical attack vector.

While TLS certificates and username/password handle authentication (who the device is), they do not control authorization (what the device is allowed to do). Topic-based Access Control Lists (ACLs) are the specific mechanism used in MQTT brokers to enforce rules about which clients can publish or subscribe to specific topic patterns. This directly addresses the principle of least privilege required by the scenario.

Data minimization is the principle of collecting and retaining only the data that is strictly necessary for a specific purpose. An 'event-only' recording mode directly applies this principle by avoiding the collection of continuous, unnecessary footage and only capturing data relevant to a security event (motion). The other options either increase data collection or relate to security and transparency, not minimization.

The payload ' OR '1'='1' is a classic SQL injection technique. The attacker is attempting to manipulate the backend SQL query by appending a condition that always evaluates to true, potentially bypassing authentication or retrieving all records from a database table. XSS involves injecting client-side scripts, CSRF tricks a user into performing an unwanted action, and path traversal involves accessing files outside the intended directory.

Adding random noise makes it much harder for an attacker to isolate the small power fluctuations related to cryptographic operations.

Constant-time algorithms ensure that operations take the same amount of time and similar power regardless of the data being processed, removing data-dependent variations an attacker could exploit.

Blinding involves randomizing the input to a cryptographic function so that the power consumption patterns are decorrelated from the actual secret key or data.