ITS-110問題集、CertNexus実際の試験問題

質問 1

An embedded developer is about to release an IoT gateway. Which of the following precautions must be taken to minimize attacks due to physical access?

A. Allow access only to the software

B. Allow easy access to components

C. Remove all unneeded physical ports

D. Install a firewall on network ports

正解: C

質問 2

An IoT security administrator wants to encrypt the database used to store sensitive IoT device dat a. Which of the following algorithms should he choose?

A. Triple Data Encryption Standard (3DES)

B. Rivest-Shamir-Adleman (RSA)

C. ElGamal

D. Secure Hash Algorithm 3-512 (SHA3-512)

正解: C

質問 3

Which of the following methods is an IoT portal administrator most likely to use in order to mitigate Distributed Denial of Service (DDoS) attacks?

A. Implement Domain Name System Security Extensions (DNSSEC) on all Internet-facing name servers

B. Require Internet Protocol Security (IPSec) for all inbound portal connections

C. Disable Network Address Translation Traversal (NAT-T) at the border firewall

D. Implement traffic scrubbers on the upstream Internet Service Provider (ISP) connection

正解: D

質問 4

A hacker wants to record a live session between a user and a host in hopes that parts of the datastream can be used to spoof the session. Which of the following attacks is this person attempting?

A. Session replay

B. Fuzzing

C. Reverse shell

D. Bit flipping

正解: A

質問 5

You work for a multi-national IoT device vendor. Your European customers are complaining about their inability to access the personal information about them that you have collected. Which of the following regulations is your organization at risk of violating?

A. Electronic Identification Authentication and Trust Services (elDAS)

B. General Data Protection Regulation (GDPR)

C. Database Service on Alternative Methods (DB-ALM)

D. Sarbanes-Oxley (SOX)

正解: B

質問 6

A hacker wants to discover login names that may exist on a website. Which of the following responses to the login and password entries would aid in the discovery? (Choose two.)

A. The username and/or password are incorrect

B. Invalid password

C. Incorrect email/password combination

D. That user does not exist

E. Your login attempt was unsuccessful

正解: D,E

質問 7

In order to successfully perform a man-in-the-middle (MITM) attack against a secure website, which of the following could be true?

A. The server must be vulnerable to malformed Uniform Resource Locator (URL) injection

B. The web server's X.509 certificate must be compromised

C. The server must be using a deprecated version of Transport Layer Security (TLS)

D. Client to server traffic must use Hypertext Transmission Protocol (HTTP)

正解: C

質問 8

An IoT security practitioner should be aware of which common misconception regarding data in motion?

A. That data can change instantly so old data is of no value.

B. The assumption that all data is encrypted properly and cannot be exploited.

C. The assumption that network protocols automatically encrypt data on the fly.

D. That transmitted data is point-to-point and therefore a third party does not exist.

正解: B

質問 9

An IoT developer needs to ensure that user passwords for a smartphone app are stored securely. Which of the following methods should the developer use to meet this requirement?

A. Encrypt all stored passwords using 256-bit Advanced Encryption Standard (AES-256)

B. Store all passwords in read-only memory

C. Encrypt all stored passwords using 128-bit Twofish

D. Hash all passwords using Message Digest 5 (MD5)

正解: A

CertNexus Certified Internet of Things Security Practitioner - ITS-110 模擬練習