CertNexus New 2024 ITS-110 Sample Questions Reliable ITS-110 Test Engine [Q27-Q50]

5/5 - (1 vote)

CertNexus New 2024 ITS-110 Sample Questions Reliable ITS-110 Test Engine

Feel CertNexus ITS-110 Dumps PDF Will likely be The best Option

The Internet of Things (IoT) is rapidly growing and permeating all aspects of our lives, from smart homes to connected vehicles to healthcare devices. With this growth, the demand for professionals who can secure these IoT devices and networks is also increasing. The CertNexus ITS-110 (Certified Internet of Things Security Practitioner) exam is designed to validate the knowledge and skills required to secure IoT devices and networks.

CertNexus ITS-110 (Certified Internet of Things Security Practitioner) Exam is a certification program that validates an individual’s knowledge and skills in securing the Internet of Things (IoT) devices and networks. The IoT is a rapidly growing technology that connects everyday objects to the internet, such as home appliances, medical devices, and even vehicles. However, this technology also brings new security challenges, making it crucial for professionals to understand how to protect these devices and networks from cyber threats.

QUESTION 27
If a site administrator wants to improve the secure access to a cloud portal, which of the following would be the BEST countermeasure to implement?

Require frequent password changes

Mandate multi-factor authentication (MFA)

Utilize role-based access control (RBAC)

Require separation of duties

QUESTION 28
A user grants an IoT manufacturer consent to store personally identifiable information (PII). According to the General Data Protection Regulation (GDPR), when is an organization required to delete this data?

Within ninety days after collection, unless required for a legal proceeding

Within thirty days of a user’s written request

Within seven days of being transferred to secure, long-term storage

Within sixty days after collection, unless encrypted

QUESTION 29
An IoT security administrator is concerned that someone could physically connect to his network and scan for vulnerable devices. Which of the following solutions should he install to prevent this kind of attack?

Media Access Control (MAC)

Network Access Control (NAC)

Host Intrusion Detection System (HIDS)

Network Intrusion Detection System (NIDS)

QUESTION 30
An IoT systems administrator wants to ensure that all data stored on remote IoT gateways is unreadable. Which of the following technologies is the administrator most likely to implement?

Secure Hypertext Transmission Protocol (HTTPS)

Internet Protocol Security (IPSec)

Triple Data Encryption Standard (3DES)

Message Digest 5 (MD5)

QUESTION 31
If an attacker were able to gain access to a user’s machine on your network, which of the following actions would she most likely take next?

Start log scrubbing

Escalate privileges

Perform port scanning

Initiate reconnaissance

QUESTION 32
An IoT security architect wants to implement Bluetooth between two nodes. The Elliptic Curve Diffie-Hellman (ECDH) cipher suite has been identified as a requirement. Which of the following Bluetooth versions can meet this requirement?

Bluetooth Low Energy (BLE) v4.0

BLE v4.2

BLE v4.1

Any of the BLE versions

QUESTION 33
If an attacker were able to gain access to a user’s machine on your network, which of the following actions would she most likely take next?

Start log scrubbing

Escalate privileges

Perform port scanning

Initiate reconnaissance

QUESTION 34
An IoT developer needs to ensure that user passwords for a smartphone app are stored securely. Which of the following methods should the developer use to meet this requirement?

Encrypt all stored passwords using 256-bit Advanced Encryption Standard (AES-256)

Encrypt all stored passwords using 128-bit Twofish

Hash all passwords using Message Digest 5 (MD5)

Store all passwords in read-only memory

QUESTION 35
You work for a multi-national IoT device vendor. Your European customers are complaining about their inability to access the personal information about them that you have collected. Which of the following regulations is your organization at risk of violating?

Sarbanes-Oxley (SOX)

General Data Protection Regulation (GDPR)

Electronic Identification Authentication and Trust Services (elDAS)

Database Service on Alternative Methods (DB-ALM)

QUESTION 36
An IoT software developer strives to reduce the complexity of his code to allow for efficient design and implementation. Which of the following terms describes the design principle he is implementing?

Calibration

Demodulation

Encapsulation

Abstraction

QUESTION 37
An embedded developer is about to release an IoT gateway. Which of the following precautions must be taken to minimize attacks due to physical access?

Allow access only to the software

Remove all unneeded physical ports

Install a firewall on network ports

Allow easy access to components

QUESTION 38
An IoT manufacturer needs to ensure that firmware flaws can be addressed even after their devices have been deployed. Which of the following methods should the manufacturer use to meet this requirement?

Ensure that the bootloader can be accessed remotely using Secure Shell (SSH)

Ensure that a writable copy of the device’s configuration is stored in flash memory

Ensure that device can accept Over-the-Air (OTA) firmware updates

Ensure that ail firmware is signed using digital certificates prior to deployment

QUESTION 39
You work for an IoT software-as-a-service (SaaS) provider. Your boss has asked you to research a way to effectively dispose of stored sensitive customer dat a. Which of the following methods should you recommend to your boss?

Crypto-shredding

Degaussing

Overwriting

Physical destruction

QUESTION 40
A hacker is able to access privileged information via an IoT portal by modifying a SQL parameter in a URL. Which of the following BEST describes the vulnerability that allows this type of attack?

Unvalidated redirect or forwarding

Insecure HTTP session management

Unsecure direct object references

Unhandled malformed URLs

QUESTION 41
A hacker wants to record a live session between a user and a host in hopes that parts of the datastream can be used to spoof the session. Which of the following attacks is this person attempting?

Fuzzing

Session replay

Bit flipping

Reverse shell

QUESTION 42
An IoT developer wants to ensure that their cloud management portal is protected against compromised end-user credentials. Which of the following technologies should the developer implement?

An authentication policy that requires a password at initial logon, and a second password in order to access advanced features.

An authentication policy which requires user passwords to include twelve characters, including uppercase, lowercase, and special characters.

An authentication policy that requires a user to provide a strong password and on-demand token delivered via SMS.

An authentication policy which requires two random tokens generated by a hardware device.

QUESTION 43
A DevOps engineer wants to provide secure network services to an IoT/cloud solution. Which of the following countermeasures should be implemented to mitigate network attacks that can render a network useless?

Network firewall

Denial of Service (DoS)/Distributed Denial of Service (DDoS) mitigation

Web application firewall (WAF)

Deep Packet Inspection (DPI)

QUESTION 44
Which of the following functions can be added to the authorization component of AAA to enable the principal of least privilege with flexibility?

Discretionary access control (DAC)

Role-based access control (RBAC)

Mandatory access control (MAC)

Access control list (ACL)

QUESTION 45
A web application is connected to an IoT endpoint. A hacker wants to steal data from the connection between them. Which of the following is NOT a method of attack that could be used to facilitate stealing data?

Cross-Site Request Forgery (CSRF)

SQL Injection (SQLi)

Cross-Site Scripting (XSS)

LDAP Injection

QUESTION 46
An IoT security administrator wishes to mitigate the risk of falling victim to Distributed Denial of Service (DDoS) attacks. Which of the following mitigation strategies should the security administrator implement? (Choose two.)

Block all inbound packets with an internal source IP address

Block all inbound packets originating from service ports

Enable unused Transmission Control Protocol (TCP) service ports in order to create a honeypot

Block the use of Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) through his perimeter firewall

Require the use of X.509 digital certificates for all incoming requests

QUESTION 47
An IoT developer has endpoints that are shipped to users in the field. Which of the following best practices must be implemented for using default passwords after delivery?

Implement two-factor authentication (2FA)

Force a password change upon initial login

Apply granular role-based access

Protect against account enumeration

QUESTION 48
A cloud developer for an IoT service is storing billing information. Which of the following should be considered a common vulnerability in regard to this data that could be used to compromise privacy?

Enabled notifications as required by law

Lack of data retention policies

Authorized access to personal information

Secured data in motion and at rest

QUESTION 49
An IoT systems integrator has a very old IoT gateway that doesn’t offer many security features besides viewing a system configuration page via browser over HTTPS. The systems integrator can’t get their modern browser to bring up the page due to a cipher suite mismatch. Which of the following must the integrator perform before the configuration page can be viewed?

Upgrade the browser, as modern browsers have stopped allowing connections to hosts that use only outdated cipher suites.

Downgrade the browser, as modern browsers have stopped allowing connections to hosts that use only outdated cipher suites.

Upgrade the browser, as older browsers have stopped allowing connections to hosts that use only outdated cipher suites.

Downgrade the browser, as modern browsers have continued allowing connections to hosts that use only outdated cipher suites.

QUESTION 50
A web administrator is concerned about injection attacks. Which of the following mitigation techniques should the web administrator implement?

Configure single sign-on (SSO)

Parameter validation

Require strong passwords

Require two-factor authentication (2FA)

Loading …