1. Which of the following is a primary security concern for IoT devices?
A) High power consumption
B) Limited internet bandwidth
C) Lack of built-in security features
D) Large storage capacity
✅ Answer: C) Lack of built-in security features
📌 Explanation: Many IoT devices lack fundamental security mechanisms like encryption, secure boot, and proper authentication, making them vulnerable to attacks.
2. Why is weak authentication a significant issue in IoT security?
A) IoT devices are difficult to hack
B) Many IoT devices use default or weak passwords
C) IoT devices do not connect to the internet
D) All IoT devices come with strong authentication by default
✅ Answer: B) Many IoT devices use default or weak passwords
📌 Explanation: Many IoT devices come with default credentials that are rarely changed, making them an easy target for brute-force attacks.
3. What type of attack occurs when an IoT device is exploited to launch large-scale network attacks?
A) Ransomware Attack
B) Man-in-the-Middle Attack
C) Botnet Attack
D) Zero-Day Attack
✅ Answer: C) Botnet Attack
📌 Explanation: Compromised IoT devices can be recruited into a botnet, which attackers use to conduct DDoS attacks or other malicious activities.
4. How can insecure firmware updates lead to IoT vulnerabilities?
A) Updates can introduce new features but remove security patches
B) Hackers can inject malicious code through unverified updates
C) Firmware updates consume too much bandwidth
D) All IoT devices automatically receive secure updates
✅ Answer: B) Hackers can inject malicious code through unverified updates
📌 Explanation: If firmware updates are not digitally signed and verified, attackers can inject malicious code into the IoT device.
5. What is a major risk when IoT devices lack proper encryption?
A) Users cannot access their data
B) Attackers can eavesdrop on communications and steal sensitive data
C) IoT devices overheat quickly
D) Encryption is not necessary for IoT devices
✅ Answer: B) Attackers can eavesdrop on communications and steal sensitive data
📌 Explanation: Without encryption, attackers can intercept and modify communications between IoT devices, leading to data leaks and unauthorized access.
6. What is a common method hackers use to exploit insecure IoT devices?
A) Ransomware infections
B) Brute-force attacks on default passwords
C) Overclocking the processor
D) Battery drain attacks
✅ Answer: B) Brute-force attacks on default passwords
📌 Explanation: Attackers often use automated brute-force attacks to guess weak/default passwords, gaining access to IoT devices.
7. What IoT vulnerability allows attackers to take full control over a device remotely?
A) Cross-Site Scripting (XSS)
B) Remote Code Execution (RCE)
C) SQL Injection
D) Session Fixation
✅ Answer: B) Remote Code Execution (RCE)
📌 Explanation: RCE vulnerabilities allow hackers to execute malicious commands remotely, potentially taking over the IoT device.
8. Why is poor IoT device update management a security risk?
A) Updates slow down device performance
B) Devices may become incompatible with new networks
C) Outdated devices remain vulnerable to known exploits
D) Updates consume too much power
✅ Answer: C) Outdated devices remain vulnerable to known exploits
📌 Explanation: Many IoT devices do not receive regular security updates, leaving them exposed to previously discovered vulnerabilities.
9. How can attackers exploit insecure APIs in IoT ecosystems?
A) By sending malicious requests to bypass authentication
B) By overheating the device
C) By consuming excessive bandwidth
D) By forcing the device to reset
✅ Answer: A) By sending malicious requests to bypass authentication
📌 Explanation: Insecure APIs can allow attackers to manipulate device functions, extract sensitive data, or even take full control.
10. What IoT attack uses weak default credentials to compromise multiple devices quickly?
A) Phishing Attack
B) MITM Attack
C) Mirai Botnet Attack
D) Rootkit Injection
✅ Answer: C) Mirai Botnet Attack
📌 Explanation: Mirai botnet targets IoT devices with weak or default credentials and recruits them into a botnet for large-scale attacks.
11. Why is IoT device visibility a security concern?
A) Many organizations lack a clear inventory of connected IoT devices
B) IoT devices are always safe from cyberattacks
C) IoT devices require physical access for security breaches
D) Visibility improves attack execution
✅ Answer: A) Many organizations lack a clear inventory of connected IoT devices
📌 Explanation: Without proper device monitoring, organizations cannot detect unauthorized devices or apply necessary security measures.
12. Which of the following is NOT a common IoT vulnerability?
A) Hardcoded credentials
B) Unpatched firmware
C) Multi-factor authentication (MFA)
D) Insecure network services
✅ Answer: C) Multi-factor authentication (MFA)
📌 Explanation: MFA enhances security, while hardcoded credentials, unpatched firmware, and insecure network services are major IoT security risks.
13. What is an effective way to secure IoT devices?
A) Disable encryption
B) Change default passwords
C) Avoid updating firmware
D) Keep devices online 24/7
✅ Answer: B) Change default passwords
📌 Explanation: Changing default passwords prevents easy exploitation by attackers using default login credentials.
14. Which security measure prevents IoT devices from unauthorized access?
A) Open Wi-Fi networks
B) Disabling logs
C) Network segmentation
D) Allowing hardcoded credentials
✅ Answer: C) Network segmentation
📌 Explanation: Network segmentation isolates IoT devices, preventing them from being compromised or used in lateral attacks.
15. What is a key risk when using smart home IoT devices?
A) They consume too much electricity
B) They can be hacked to spy on users
C) They require frequent reboots
D) They cannot connect to the internet
✅ Answer: B) They can be hacked to spy on users
📌 Explanation: Many smart home devices have weak security, allowing attackers to gain unauthorized access to cameras, microphones, and data.
16. What makes IoT devices particularly vulnerable to physical attacks?
A) They are always connected to a secure network
B) Many lack physical security protections like tamper detection
C) They have unbreakable encryption
D) They self-destruct if tampered with
✅ Answer: B) Many lack physical security protections like tamper detection
📌 Explanation: Many IoT devices lack tamper-proof features, allowing attackers to physically modify them, extract data, or insert malicious firmware.
17. Which network protocol is commonly exploited in IoT attacks?
A) HTTP
B) SSH
C) Telnet
D) SMTP
✅ Answer: C) Telnet
📌 Explanation: Telnet is often exploited due to its lack of encryption and common use of default credentials in IoT devices.
18. What is the primary purpose of implementing TLS in IoT communications?
A) To provide faster internet speeds
B) To ensure data confidentiality and integrity
C) To increase battery life of IoT devices
D) To block all unauthorized devices from connecting
✅ Answer: B) To ensure data confidentiality and integrity
📌 Explanation: Transport Layer Security (TLS) encrypts communication between devices, preventing eavesdropping and man-in-the-middle attacks.
19. Which attack involves intercepting and altering IoT device communications?
A) Denial-of-Service (DoS)
B) Man-in-the-Middle (MITM)
C) Rootkit Injection
D) Privilege Escalation
✅ Answer: B) Man-in-the-Middle (MITM)
📌 Explanation: MITM attacks allow attackers to intercept and manipulate data being transmitted between IoT devices and networks.
20. What is a key danger of allowing remote access to IoT devices?
A) Devices consume more power
B) It increases latency in network communication
C) Attackers can exploit open ports for unauthorized access
D) Remote access has no security risks
✅ Answer: C) Attackers can exploit open ports for unauthorized access
📌 Explanation: Open ports (e.g., port 23 for Telnet, port 22 for SSH) can be brute-forced or exploited if not secured properly.
21. What security measure can prevent attackers from gaining access via brute-force attacks?
A) Using simple passwords
B) Disabling logs
C) Implementing rate limiting and account lockouts
D) Allowing unrestricted login attempts
✅ Answer: C) Implementing rate limiting and account lockouts
📌 Explanation: Rate limiting and account lockouts reduce the risk of brute-force password attacks.
22. What IoT vulnerability can allow attackers to bypass authentication mechanisms?
A) SQL Injection
B) Hardcoded Credentials
C) Command Injection
D) API Rate Limiting
✅ Answer: B) Hardcoded Credentials
📌 Explanation: Hardcoded credentials in firmware allow attackers to log in with known, unchangeable passwords.
23. Which of these is NOT a recommended IoT security measure?
A) Enabling strong encryption
B) Using default manufacturer settings
C) Regularly updating firmware
D) Implementing access control
✅ Answer: B) Using default manufacturer settings
📌 Explanation: Default settings (such as passwords and open ports) are commonly exploited by attackers.
24. What can happen if an IoT device is connected to a public Wi-Fi network?
A) Nothing, IoT devices are secure by default
B) The device may be exposed to unauthorized access and attacks
C) The device will stop working
D) The network will automatically encrypt all communications
✅ Answer: B) The device may be exposed to unauthorized access and attacks
📌 Explanation: Public Wi-Fi networks lack security, making connected IoT devices vulnerable to sniffing, MITM attacks, and unauthorized access.
25. What is a major consequence of not securing IoT cloud connections?
A) Limited device storage
B) Data breaches and unauthorized access
C) Slow response times
D) Overheating of IoT devices
✅ Answer: B) Data breaches and unauthorized access
📌 Explanation: Weak authentication and encryption in cloud-based IoT services can lead to data leaks and system compromises.
26. Which of the following is a best practice for IoT network security?
A) Keeping all IoT devices on the same network as critical systems
B) Using default manufacturer credentials
C) Implementing VLANs and network segmentation
D) Allowing unrestricted remote access
✅ Answer: C) Implementing VLANs and network segmentation
📌 Explanation: Segmenting IoT devices into separate networks reduces attack surface and limits lateral movement.
27. Why is insecure storage of sensitive data a threat to IoT security?
A) It can lead to unauthorized data access and breaches
B) IoT devices do not store any sensitive data
C) Data encryption is not necessary for IoT security
D) It only affects devices with large storage capacity
✅ Answer: A) It can lead to unauthorized data access and breaches
📌 Explanation: Storing credentials or sensitive data in plaintext allows attackers to extract and misuse the information.
28. What is an effective way to prevent firmware tampering in IoT devices?
A) Keeping the device turned off
B) Implementing secure boot and signed firmware updates
C) Not updating firmware at all
D) Using an older version of firmware
✅ Answer: B) Implementing secure boot and signed firmware updates
📌 Explanation: Secure boot and signed updates prevent installation of malicious or unauthorized firmware.
29. What is a “side-channel attack” on IoT devices?
A) An attack that manipulates power consumption, timing, or electromagnetic emissions to extract data
B) A direct hacking attempt using brute-force methods
C) A method of social engineering attacks
D) An attack where IoT devices are shut down remotely
✅ Answer: A) An attack that manipulates power consumption, timing, or electromagnetic emissions to extract data
📌 Explanation: Side-channel attacks exploit physical properties of a device to extract sensitive data.
30. Which cryptographic measure can ensure secure IoT communication?
A) Plaintext transmission
B) Hardcoded encryption keys
C) End-to-End Encryption (E2EE)
D) Using weak hashing algorithms
✅ Answer: C) End-to-End Encryption (E2EE)
📌 Explanation: E2EE ensures that data is encrypted at the sender and decrypted only at the intended recipient.
31. What vulnerability allows attackers to manipulate IoT device firmware remotely?
A) Privilege Escalation
B) Insecure OTA (Over-the-Air) Updates
C) Phishing Attacks
D) Session Fixation
✅ Answer: B) Insecure OTA (Over-the-Air) Updates
📌 Explanation: If OTA updates are not properly secured, attackers can inject malicious firmware into IoT devices.
32. How can manufacturers improve IoT security?
A) Encrypting sensitive data
B) Enforcing strong authentication mechanisms
C) Releasing regular security updates
D) All of the above
✅ Answer: D) All of the above
📌 Explanation: Encryption, strong authentication, and regular updates are key to reducing IoT security risks.
33. Why are IoT devices a prime target for cybercriminals?
A) They are always turned off
B) They have strong security by default
C) They are often poorly secured and widely deployed
D) They do not store any useful data
✅ Answer: C) They are often poorly secured and widely deployed
📌 Explanation: IoT devices often lack proper security configurations and are deployed in large numbers, making them attractive targets for hackers.
34. What is an insecure IoT device most likely to become part of?
A) A software update system
B) A botnet for launching cyberattacks
C) A secure data center
D) A backup network
✅ Answer: B) A botnet for launching cyberattacks
📌 Explanation: Compromised IoT devices are frequently recruited into botnets that are used for DDoS attacks and malware distribution.
35. What is the best way to prevent attackers from exploiting open ports on IoT devices?
A) Blocking unnecessary ports and enabling firewalls
B) Allowing unrestricted access to all ports
C) Using weak passwords to avoid suspicion
D) Disabling encryption
✅ Answer: A) Blocking unnecessary ports and enabling firewalls
📌 Explanation: Closing unnecessary ports and using firewalls helps restrict unauthorized access and reduces attack surfaces.
36. Why is lack of multi-factor authentication (MFA) a risk in IoT security?
A) It makes it easier for attackers to gain unauthorized access
B) It speeds up authentication
C) MFA is not relevant to IoT security
D) IoT devices cannot support MFA
✅ Answer: A) It makes it easier for attackers to gain unauthorized access
📌 Explanation: Without MFA, attackers can easily gain access using stolen or guessed credentials.
37. How do attackers exploit weak encryption in IoT devices?
A) By using strong passwords
B) By performing cryptographic attacks to decrypt sensitive data
C) By limiting network access
D) By enabling automatic updates
✅ Answer: B) By performing cryptographic attacks to decrypt sensitive data
📌 Explanation: Weak encryption algorithms can be cracked by attackers, exposing sensitive data.
38. What is the primary role of a Secure Element (SE) in IoT devices?
A) Enhancing battery life
B) Storing sensitive data and performing secure operations
C) Increasing network speed
D) Preventing hardware failures
✅ Answer: B) Storing sensitive data and performing secure operations
📌 Explanation: Secure Elements (SEs) are tamper-resistant chips that store encryption keys, credentials, and sensitive data securely.
39. How can physical tampering with an IoT device be detected?
A) By monitoring power consumption
B) Using tamper-resistant hardware and sensors
C) By increasing network speed
D) By disabling logging features
✅ Answer: B) Using tamper-resistant hardware and sensors
📌 Explanation: Tamper-resistant designs and sensors can detect and respond to unauthorized physical access.
40. Why are insecure IoT supply chains a cybersecurity risk?
A) Attackers can insert malicious components before deployment
B) They increase battery life
C) They prevent software updates
D) They improve device efficiency
✅ Answer: A) Attackers can insert malicious components before deployment
📌 Explanation: Supply chain attacks involve compromising hardware or software before an IoT device is even deployed.
41. What can happen if an IoT device lacks proper access controls?
A) Unauthorized users can gain full control over the device
B) The device becomes more secure
C) The device loses its internet connection
D) The device stops working
✅ Answer: A) Unauthorized users can gain full control over the device
📌 Explanation: Weak access controls allow attackers to gain administrative control and manipulate device functions.
42. What is an effective way to secure IoT cloud services?
A) Using strong authentication and encryption
B) Keeping all APIs open to the public
C) Storing passwords in plaintext
D) Disabling firmware updates
✅ Answer: A) Using strong authentication and encryption
📌 Explanation: Encrypting cloud communications and enforcing strong authentication helps prevent unauthorized access.
43. Why is unencrypted data storage on IoT devices a risk?
A) Attackers can extract sensitive data if they gain access
B) It improves device performance
C) It makes data recovery easier
D) It prevents unauthorized access
✅ Answer: A) Attackers can extract sensitive data if they gain access
📌 Explanation: Unencrypted storage means sensitive data can be extracted if an attacker physically accesses or hacks the device.
44. What type of malware is commonly used to target IoT devices?
A) Ransomware
B) Spyware
C) Worms
D) Botnet malware
✅ Answer: D) Botnet malware
📌 Explanation: Botnet malware infects large numbers of IoT devices, using them for DDoS attacks, spam distribution, or data exfiltration.
45. What does a firmware rollback attack exploit?
A) The ability to downgrade firmware to an older, vulnerable version
B) The speed of a device’s processor
C) The network connection type
D) The battery life of a device
✅ Answer: A) The ability to downgrade firmware to an older, vulnerable version
📌 Explanation: Firmware rollback attacks exploit the lack of version enforcement, allowing attackers to reinstall old firmware with known vulnerabilities.
46. Which attack can exploit IoT devices to spy on users through microphones and cameras?
A) Drive-by Download Attack
B) Eavesdropping Attack
C) Denial-of-Service Attack
D) Bluejacking
✅ Answer: B) Eavesdropping Attack
📌 Explanation: Attackers can gain unauthorized access to IoT cameras and microphones to spy on users.
47. What is a “Zigbee Replay Attack”?
A) An attack where old Zigbee protocol messages are captured and resent
B) A method of speeding up IoT network communication
C) A vulnerability in industrial robots
D) A way to improve IoT device battery life
✅ Answer: A) An attack where old Zigbee protocol messages are captured and resent
📌 Explanation: In a Zigbee Replay Attack, attackers capture and replay previously transmitted commands, potentially taking control of IoT devices.
48. What security feature can prevent unauthorized firmware modifications?
A) Secure Boot
B) Open source code
C) Enabling remote access
D) Disabling logs
✅ Answer: A) Secure Boot
📌 Explanation: Secure Boot ensures that only trusted and signed firmware is loaded onto an IoT device, preventing malicious firmware injections.
49. Which IoT vulnerability allows attackers to send unauthorized commands to a device by exploiting its web interface?
A) SQL Injection
B) Cross-Site Request Forgery (CSRF)
C) Denial-of-Service
D) Packet Sniffing
✅ Answer: B) Cross-Site Request Forgery (CSRF)
📌 Explanation: CSRF attacks trick a user into executing unintended commands on an IoT device’s web interface.
50. What is the best way to prevent IoT devices from being compromised?
A) Implementing strong authentication, encryption, and regular updates
B) Using default passwords
C) Connecting to public Wi-Fi
D) Allowing open remote access
✅ Answer: A) Implementing strong authentication, encryption, and regular updates
📌 Explanation: A combination of authentication, encryption, and frequent security updates is key to securing IoT devices.
51. Which of the following is a primary concern when an IoT device is connected to an unprotected MQTT broker?
A) Reduced battery life
B) Unauthorized data interception and control
C) Slower data transmission
D) Increased network congestion
✅ Answer: B) Unauthorized data interception and control
📌 Explanation: MQTT brokers transmit data without encryption by default, allowing attackers to intercept and manipulate messages if proper security measures aren’t in place.
52. What is the biggest risk of using IoT devices with outdated firmware?
A) Decreased battery performance
B) Exposure to known vulnerabilities and exploits
C) Incompatibility with new Wi-Fi routers
D) IoT device overheating
✅ Answer: B) Exposure to known vulnerabilities and exploits
📌 Explanation: Outdated firmware often contains known security flaws, making IoT devices an easy target for attackers.
53. What can an attacker accomplish with an IoT “side-channel attack”?
A) Extract sensitive information by analyzing power consumption or electromagnetic emissions
B) Modify firmware without authorization
C) Bypass network encryption
D) Remotely disable IoT devices
✅ Answer: A) Extract sensitive information by analyzing power consumption or electromagnetic emissions
📌 Explanation: Side-channel attacks exploit physical characteristics like power usage and electromagnetic signals to extract cryptographic keys or other sensitive data.
54. Why is UPnP (Universal Plug and Play) dangerous in IoT security?
A) It prevents devices from connecting to networks
B) It automatically opens ports on a router without authentication
C) It blocks unauthorized access by default
D) It encrypts all IoT communications
✅ Answer: B) It automatically opens ports on a router without authentication
📌 Explanation: UPnP can be exploited to open network ports automatically, allowing attackers to bypass firewalls and access IoT devices remotely.
55. Which wireless technology is commonly used in IoT but can be vulnerable to jamming attacks?
A) Bluetooth Low Energy (BLE)
B) Zigbee
C) Wi-Fi
D) All of the above
✅ Answer: D) All of the above
📌 Explanation: Jamming attacks disrupt wireless signals, and all these technologies are susceptible to signal interference and DoS attacks.
56. What does an IoT “firmware backdoor” allow attackers to do?
A) Remotely control the device without the user’s knowledge
B) Improve device performance
C) Secure the device against malware
D) Prevent unauthorized access
✅ Answer: A) Remotely control the device without the user’s knowledge
📌 Explanation: Backdoors in firmware provide unauthorized access, allowing attackers to control the device or extract sensitive information.
57. What is an effective method to prevent IoT replay attacks?
A) Using strong encryption and nonces for authentication
B) Enabling default device configurations
C) Allowing open Wi-Fi access
D) Disabling software updates
✅ Answer: A) Using strong encryption and nonces for authentication
📌 Explanation: Replay attacks involve capturing and reusing authentication messages, which can be prevented by using nonces (one-time random values) and encryption.
58. How can insecure IoT web interfaces be exploited?
A) Through weak authentication and lack of input validation
B) By using multi-factor authentication
C) By regularly updating firmware
D) By using end-to-end encryption
✅ Answer: A) Through weak authentication and lack of input validation
📌 Explanation: Many IoT devices have web interfaces that lack security, making them vulnerable to brute-force attacks, CSRF, and command injections.
59. What can happen if IoT devices do not properly validate input data?
A) Attackers can execute code remotely (RCE)
B) The device will operate faster
C) The device will automatically fix errors
D) The network connection will be lost
✅ Answer: A) Attackers can execute code remotely (RCE)
📌 Explanation: Lack of input validation can lead to command injection and remote code execution (RCE), allowing an attacker to gain full control over the device.
60. Why is static encryption key usage a serious security flaw in IoT devices?
A) Attackers can easily decrypt communications if they extract the key
B) It improves device performance
C) It ensures data security at all times
D) It helps with faster authentication
✅ Answer: A) Attackers can easily decrypt communications if they extract the key
📌 Explanation: Static keys (hardcoded in firmware) can be extracted and reused by attackers, leading to massive security breaches.
61. How can manufacturers secure IoT APIs?
A) Implementing strong authentication, rate limiting, and encrypted data exchange
B) Allowing open API access
C) Using weak credentials for debugging
D) Keeping API endpoints exposed
✅ Answer: A) Implementing strong authentication, rate limiting, and encrypted data exchange
📌 Explanation: Secure APIs require authentication, encryption, and rate limiting to prevent unauthorized access.
62. Why is logging and monitoring important for IoT security?
A) It helps detect and respond to security incidents in real-time
B) It slows down device performance
C) It increases power consumption
D) It is not relevant to IoT security
✅ Answer: A) It helps detect and respond to security incidents in real-time
📌 Explanation: Security logs and monitoring can help detect anomalous activities, brute-force attacks, and malware infections.
63. What is a common risk of IoT voice assistants?
A) They can be tricked by adversarial voice commands
B) They consume too much power
C) They only process voice commands locally
D) They cannot be hacked
✅ Answer: A) They can be tricked by adversarial voice commands
📌 Explanation: Attackers can use adversarial AI techniques to issue hidden voice commands that manipulate IoT assistants.
64. Why should default IoT device credentials be changed?
A) They are widely known and used in brute-force attacks
B) It makes no difference to security
C) It slows down device boot time
D) It is required by law
✅ Answer: A) They are widely known and used in brute-force attacks
📌 Explanation: Default credentials are commonly published online, making IoT devices vulnerable to brute-force and dictionary attacks.
65. Which attack exploits weak IoT device firmware updates?
A) Phishing attack
B) Firmware downgrade attack
C) Cross-site scripting (XSS)
D) Clickjacking
✅ Answer: B) Firmware downgrade attack
📌 Explanation: Attackers force devices to revert to an older, vulnerable firmware version, allowing them to exploit known vulnerabilities.
66. What is an example of an IoT device targeted in a real-world cyberattack?
A) Smart refrigerators
B) IP cameras
C) Industrial sensors
D) All of the above
✅ Answer: D) All of the above
📌 Explanation: Many IoT devices (including smart home devices, IP cameras, and industrial systems) have been targeted in cyberattacks.
67. What IoT security principle involves ensuring that devices only run trusted firmware?
A) Secure Boot
B) Data Compression
C) Overclocking Prevention
D) Disabling Remote Access
✅ Answer: A) Secure Boot
📌 Explanation: Secure Boot prevents IoT devices from running malicious or unauthorized firmware.
68. How can users protect their IoT devices from DDoS attacks?
A) Disabling unnecessary internet access and using network segmentation
B) Connecting all devices to the same Wi-Fi network
C) Using factory default settings
D) Avoiding encryption
✅ Answer: A) Disabling unnecessary internet access and using network segmentation
📌 Explanation: Restricting IoT internet access and segregating networks reduces the risk of IoT-based DDoS attacks.
69. Why are IoT devices particularly vulnerable to “default open services”?
A) They consume more power when services are open
B) Attackers can exploit open services to gain unauthorized access
C) Open services increase device speed
D) IoT devices automatically secure all open services
✅ Answer: B) Attackers can exploit open services to gain unauthorized access
📌 Explanation: Many IoT devices ship with unnecessary services enabled (e.g., FTP, Telnet, SSH) that attackers can exploit if not properly secured.
70. What is a common issue with IoT devices that lack logging capabilities?
A) They consume more storage
B) Security incidents go undetected
C) They become slower
D) They stop connecting to networks
✅ Answer: B) Security incidents go undetected
📌 Explanation: Without logging, organizations cannot monitor suspicious activities, making it difficult to detect and respond to attacks.
71. How can attackers exploit IoT devices using a “DNS Rebinding” attack?
A) By redirecting the device to malicious servers
B) By increasing the speed of DNS queries
C) By blocking all device communications
D) By preventing firmware updates
✅ Answer: A) By redirecting the device to malicious servers
📌 Explanation: DNS rebinding tricks devices into connecting to malicious servers, allowing attackers to steal data or execute commands.
72. What IoT security measure helps prevent unauthorized firmware modifications?
A) Secure Boot and Code Signing
B) Disabling encryption
C) Keeping the device always online
D) Using factory default settings
✅ Answer: A) Secure Boot and Code Signing
📌 Explanation: Secure Boot ensures that only trusted firmware runs, while code signing prevents unauthorized modifications.
73. Why are many IoT devices vulnerable to “backdoor access”?
A) They use encrypted connections by default
B) Manufacturers sometimes include undocumented access points
C) All IoT devices require strong authentication
D) They cannot be updated remotely
✅ Answer: B) Manufacturers sometimes include undocumented access points
📌 Explanation: Some IoT devices have hidden backdoors, allowing remote access for debugging, which attackers can exploit.
74. What is a “Shadow IoT” device?
A) A device that operates only at night
B) An unauthorized IoT device connected to a network
C) A highly secure IoT device
D) An IoT device that doesn’t use wireless networks
✅ Answer: B) An unauthorized IoT device connected to a network
📌 Explanation: Shadow IoT refers to unauthorized or unmanaged devices that connect to a network without IT department knowledge, posing security risks.
75. What is a key concern when IoT devices connect over 5G networks?
A) Increased power consumption
B) Faster attack execution due to lower latency
C) Slower internet speeds
D) IoT devices stop functioning
✅ Answer: B) Faster attack execution due to lower latency
📌 Explanation: 5G networks provide ultra-low latency, which can enable faster and more sophisticated cyberattacks if IoT devices are not secured.
76. Why is IoT security harder to enforce compared to traditional IT security?
A) IoT devices often lack processing power for security features
B) IoT devices are always offline
C) IoT devices are never connected to the internet
D) IoT security is automatically enforced by the manufacturer
✅ Answer: A) IoT devices often lack processing power for security features
📌 Explanation: Many IoT devices have limited processing power, making it difficult to implement strong encryption and security protocols.
77. How can attackers exploit weak IoT device authentication?
A) By performing brute-force attacks on login credentials
B) By increasing internet speeds
C) By disabling software updates
D) By preventing remote access
✅ Answer: A) By performing brute-force attacks on login credentials
📌 Explanation: Weak authentication allows attackers to use brute-force methods to guess default or weak passwords, gaining unauthorized access.
78. What is a “Replay Attack” in IoT security?
A) An attack where a previously captured communication is replayed to manipulate the device
B) A type of malware attack
C) A method for speeding up firmware updates
D) A security feature in IoT networks
✅ Answer: A) An attack where a previously captured communication is replayed to manipulate the device
📌 Explanation: Replay attacks involve capturing and retransmitting valid authentication messages to gain unauthorized access to an IoT device.
79. What role does a “Hardware Security Module (HSM)” play in IoT security?
A) It provides a secure environment for cryptographic operations
B) It increases battery life
C) It allows unrestricted device access
D) It prevents firmware updates
✅ Answer: A) It provides a secure environment for cryptographic operations
📌 Explanation: HSMs securely store encryption keys and execute cryptographic operations without exposing sensitive data to attackers.
80. Why is network segmentation important for IoT security?
A) It isolates IoT devices from critical systems
B) It improves internet speed
C) It reduces IoT device power consumption
D) It prevents IoT devices from connecting to the cloud
✅ Answer: A) It isolates IoT devices from critical systems
📌 Explanation: Segmenting IoT devices into separate networks prevents them from acting as entry points for attackers to access critical IT systems.
81. What is the primary risk of IoT devices using hardcoded encryption keys?
A) Attackers can extract the key and decrypt sensitive data
B) It increases device speed
C) It prevents unauthorized access
D) It improves wireless connectivity
✅ Answer: A) Attackers can extract the key and decrypt sensitive data
📌 Explanation: Hardcoded encryption keys stored in firmware can be extracted by attackers, compromising device security.
82. What is the function of an IoT Gateway?
A) It provides a centralized security layer between IoT devices and the internet
B) It speeds up device processing
C) It eliminates the need for encryption
D) It prevents firmware updates
✅ Answer: A) It provides a centralized security layer between IoT devices and the internet
📌 Explanation: IoT Gateways help filter, encrypt, and secure data before it reaches cloud services, reducing the attack surface.
83. Why is “device identity management” crucial in IoT security?
A) It helps prevent unauthorized devices from connecting to the network
B) It increases IoT battery life
C) It reduces data storage requirements
D) It improves Wi-Fi range
✅ Answer: A) It helps prevent unauthorized devices from connecting to the network
📌 Explanation: Strong identity management ensures that only authorized devices can communicate within an IoT ecosystem.
84. What is a risk of IoT devices with excessive permissions?
A) Attackers can misuse them to control other devices on the network
B) The device performs better
C) The device consumes less power
D) It reduces attack vectors
✅ Answer: A) Attackers can misuse them to control other devices on the network
📌 Explanation: IoT devices with excessive permissions provide attackers with higher levels of control, increasing the risk of lateral movement attacks.
85. What is a risk associated with IoT cloud misconfigurations?
A) Exposure of sensitive data due to improper access controls
B) IoT devices functioning more efficiently
C) Reduced need for software updates
D) Improved battery performance
✅ Answer: A) Exposure of sensitive data due to improper access controls
📌 Explanation: Cloud misconfigurations (e.g., misconfigured storage, weak authentication) can lead to data leaks and breaches.
86. How does a “sinkhole attack” affect IoT networks?
A) It redirects all network traffic from IoT devices to a malicious server
B) It increases IoT device speed
C) It prevents firmware updates
D) It improves encryption
✅ Answer: A) It redirects all network traffic from IoT devices to a malicious server
📌 Explanation: Sinkhole attacks manipulate routing protocols to divert IoT traffic to an attacker-controlled system.
87. What is an effective way to prevent unauthorized firmware updates on IoT devices?
A) Enforcing digitally signed updates
B) Allowing public access to the update server
C) Storing firmware updates in plaintext
D) Keeping default credentials
✅ Answer: A) Enforcing digitally signed updates
📌 Explanation: Digitally signed updates ensure that only authentic and verified firmware is installed on IoT devices.
88. What is the “BLE Spoofing” attack in IoT security?
A) An attack that impersonates a trusted Bluetooth Low Energy device
B) A method for increasing device range
C) A way to optimize battery life
D) A security feature of Bluetooth
✅ Answer: A) An attack that impersonates a trusted Bluetooth Low Energy device
📌 Explanation: BLE spoofing allows attackers to impersonate trusted Bluetooth devices, potentially stealing data or issuing unauthorized commands.
89. What makes “headless” IoT devices more difficult to secure?
A) They lack user interfaces for configuration and monitoring
B) They require strong passwords
C) They have high processing power
D) They do not support internet connections
✅ Answer: A) They lack user interfaces for configuration and monitoring
📌 Explanation: Headless IoT devices (e.g., smart sensors, embedded controllers) often lack interfaces, making security updates and monitoring challenging.
90. What is a potential danger of public IoT APIs?
A) They can be exploited by attackers if not properly secured
B) They improve device efficiency
C) They enhance encryption strength
D) They eliminate security vulnerabilities
✅ Answer: A) They can be exploited by attackers if not properly secured
📌 Explanation: Publicly exposed APIs must have strong authentication and access controls to prevent unauthorized access.
91. What role does “Zero Trust Architecture” play in IoT security?
A) It ensures no device is trusted by default, enforcing strict access controls
B) It allows unrestricted network access
C) It eliminates the need for encryption
D) It prevents firmware updates
✅ Answer: A) It ensures no device is trusted by default, enforcing strict access controls
📌 Explanation: Zero Trust enforces strict authentication and monitoring, reducing IoT attack risks.
92. What attack exploits vulnerabilities in wireless protocols like Zigbee and Z-Wave?
A) Wireless Sniffing Attacks
B) SQL Injection
C) Privilege Escalation
D) Cross-Site Scripting
✅ Answer: A) Wireless Sniffing Attacks
📌 Explanation: Wireless sniffing can capture unencrypted communication between IoT devices using Zigbee, Z-Wave, or Bluetooth.
93. What is an IoT honeypot used for?
A) To attract attackers and study their techniques
B) To improve device performance
C) To secure all IoT devices automatically
D) To eliminate firmware vulnerabilities
✅ Answer: A) To attract attackers and study their techniques
📌 Explanation: Honeypots are decoy systems designed to observe and analyze attacker behavior in IoT environments.
94. What is a common issue with “always-on” IoT microphones?
A) They can be activated by attackers to eavesdrop
B) They improve voice recognition accuracy
C) They prevent unauthorized access
D) They block malware attacks
✅ Answer: A) They can be activated by attackers to eavesdrop
📌 Explanation: Always-on microphones can be remotely activated by hackers or malware, leading to privacy breaches.
95. What is a common vulnerability in IoT cameras?
A) Weak default passwords and lack of encryption
B) High storage capacity
C) Strong authentication methods
D) Limited processing power
✅ Answer: A) Weak default passwords and lack of encryption
📌 Explanation: Many IoT cameras use default credentials, making them vulnerable to brute-force attacks and unauthorized access.
96. Why is “patching IoT devices” challenging?
A) Many IoT devices lack update mechanisms
B) Updates are always applied automatically
C) IoT devices never need updates
D) Security patches slow down devices
✅ Answer: A) Many IoT devices lack update mechanisms
📌 Explanation: Many IoT devices do not have built-in update features, making it difficult to patch security flaws.
97. What is “IoT device fingerprinting”?
A) Identifying devices based on network behavior and characteristics
B) Securing devices with biometrics
C) Blocking device access
D) Encrypting all communications
✅ Answer: A) Identifying devices based on network behavior and characteristics
📌 Explanation: Fingerprinting analyzes IoT device traffic to detect potential vulnerabilities and unauthorized activities.
98. How can IoT security be improved at the network level?
A) Using network segmentation and access controls
B) Connecting all devices to the same Wi-Fi
C) Disabling encryption
D) Allowing unrestricted API access
✅ Answer: A) Using network segmentation and access controls
📌 Explanation: Segmenting IoT devices into isolated networks limits attack exposure and reduces security risks.
99. What is a “Clickjacking” attack in IoT security?
A) Tricking a user into clicking on a disguised malicious link or button
B) Taking full control of an IoT device remotely
C) Exploiting weak encryption to decrypt traffic
D) Gaining unauthorized access through SQL injection
✅ Answer: A) Tricking a user into clicking on a disguised malicious link or button
📌 Explanation: Clickjacking tricks users into clicking elements they don’t intend to, often granting attackers access to sensitive IoT device settings.
100. How can attackers exploit IoT devices using a “Cold Boot Attack”?
A) By extracting encryption keys from device memory after a reboot
B) By disabling the power supply to force a restart
C) By slowing down the boot process to inject malware
D) By forcing the device to connect to a rogue network
✅ Answer: A) By extracting encryption keys from device memory after a reboot
📌 Explanation: Cold boot attacks allow attackers to extract encryption keys stored in RAM, even after a restart.
101. Why is “credential stuffing” a major issue for IoT devices?
A) Users often reuse passwords across multiple IoT services
B) It improves IoT security
C) It speeds up login attempts
D) It prevents unauthorized access
✅ Answer: A) Users often reuse passwords across multiple IoT services
📌 Explanation: Credential stuffing uses previously leaked username-password pairs to attempt logins on IoT devices.
102. What does “SDN” (Software-Defined Networking) offer for IoT security?
A) It provides dynamic network segmentation and access control
B) It removes encryption from IoT traffic
C) It disables firewall protections
D) It prevents firmware updates
✅ Answer: A) It provides dynamic network segmentation and access control
📌 Explanation: SDN helps segment and isolate IoT devices, reducing attack surfaces and improving network security.
103. What is a primary concern with IoT medical devices?
A) Attackers can manipulate or disable life-critical functions
B) The device runs out of battery too quickly
C) The device cannot connect to Wi-Fi
D) The device collects too much data
✅ Answer: A) Attackers can manipulate or disable life-critical functions
📌 Explanation: IoT medical devices (e.g., pacemakers, insulin pumps) must be secure to prevent malicious tampering.
104. How can attackers exploit “Zombie IoT Devices”?
A) By using them in botnet-driven cyberattacks
B) By draining their battery life
C) By improving their performance
D) By increasing their encryption
✅ Answer: A) By using them in botnet-driven cyberattacks
📌 Explanation: “Zombie IoT devices” are compromised devices controlled remotely to execute attacks, like DDoS or spam campaigns.
105. What is the risk of “Evil Twin” attacks on IoT devices?
A) IoT devices may connect to rogue Wi-Fi networks controlled by attackers
B) IoT devices will stop working
C) IoT devices will self-destruct
D) Evil Twin attacks improve IoT security
✅ Answer: A) IoT devices may connect to rogue Wi-Fi networks controlled by attackers
📌 Explanation: In Evil Twin attacks, attackers set up fake Wi-Fi networks to steal data or deliver malware to IoT devices.
106. What is a “BlueBorne” attack in IoT security?
A) An attack that exploits Bluetooth vulnerabilities to spread malware
B) A brute-force attack on IoT passwords
C) A form of social engineering
D) A vulnerability in SD cards
✅ Answer: A) An attack that exploits Bluetooth vulnerabilities to spread malware
📌 Explanation: BlueBorne exploits Bluetooth vulnerabilities to spread malware without needing user interaction.
107. How can attackers exploit “race conditions” in IoT devices?
A) By executing malicious code before security checks complete
B) By slowing down the network connection
C) By overloading the IoT device
D) By preventing firmware updates
✅ Answer: A) By executing malicious code before security checks complete
📌 Explanation: Race conditions occur when an attacker manipulates system timing to bypass security checks and execute malicious actions.
108. What is the risk of “IoT device fingerprinting” by attackers?
A) Attackers can map and identify device vulnerabilities remotely
B) It improves IoT encryption
C) It prevents unauthorized access
D) It stops brute-force attacks
✅ Answer: A) Attackers can map and identify device vulnerabilities remotely
📌 Explanation: IoT fingerprinting allows attackers to identify device types, software versions, and potential vulnerabilities.
109. What is the purpose of “Whitelisting” in IoT security?
A) It ensures only authorized applications and processes run on the device
B) It allows all devices to connect freely
C) It prevents firmware updates
D) It disables encryption
✅ Answer: A) It ensures only authorized applications and processes run on the device
📌 Explanation: Whitelisting restricts IoT devices to run only approved applications, reducing malware risks.
110. What makes “low-power IoT devices” vulnerable to cyberattacks?
A) They often lack processing power to implement strong security controls
B) They consume too much power
C) They require a high-speed internet connection
D) They use AI to prevent attacks
✅ Answer: A) They often lack processing power to implement strong security controls
📌 Explanation: Many IoT devices have limited CPU power, making it difficult to implement strong encryption and security mechanisms.
111. Why is “IoT Edge Computing” considered a security concern?
A) Edge devices process data locally and can be compromised
B) It reduces power consumption
C) It prevents unauthorized access
D) It encrypts all data automatically
✅ Answer: A) Edge devices process data locally and can be compromised
📌 Explanation: Edge computing brings data processing closer to IoT devices, making edge nodes an attractive target for cyberattacks.
112. What is a “Juice Jacking” attack, and how does it impact IoT devices?
A) Attackers use public USB charging stations to inject malware
B) It prevents overcharging of IoT batteries
C) It disables device connectivity
D) It optimizes power consumption
✅ Answer: A) Attackers use public USB charging stations to inject malware
📌 Explanation: Juice Jacking exploits public charging stations to install malware or steal data from connected IoT devices.
113. How can “Machine Learning” improve IoT security?
A) By detecting anomalies and predicting attacks in real time
B) By eliminating the need for authentication
C) By disabling encryption
D) By allowing all devices to connect freely
✅ Answer: A) By detecting anomalies and predicting attacks in real time
📌 Explanation: Machine learning can analyze IoT traffic patterns and detect anomalies to identify potential security threats.
114. What is the impact of “5G Security Risks” on IoT devices?
A) Increased attack surface due to higher device connectivity
B) Reduced processing power
C) Improved IoT battery life
D) Complete immunity to hacking
✅ Answer: A) Increased attack surface due to higher device connectivity
📌 Explanation: 5G networks enable massive IoT connectivity, but more connected devices mean a larger attack surface for hackers.
115. What is a common risk when IoT devices use outdated SSL/TLS versions?
A) They become vulnerable to Man-in-the-Middle (MITM) attacks
B) They consume more power
C) They process data faster
D) They stop transmitting data
✅ Answer: A) They become vulnerable to Man-in-the-Middle (MITM) attacks
📌 Explanation: Older versions of SSL/TLS have known vulnerabilities that attackers can exploit to intercept and alter IoT communications.
116. What makes IoT smart locks vulnerable to hacking?
A) Weak encryption and default credentials
B) Overuse of biometric authentication
C) Excessive firmware updates
D) Strong password requirements
✅ Answer: A) Weak encryption and default credentials
📌 Explanation: IoT smart locks with weak encryption and unchanged default passwords are susceptible to brute-force attacks and key extraction.
117. What is the primary security concern with IoT-enabled industrial control systems (ICS)?
A) Remote attackers can manipulate critical infrastructure
B) They consume too much electricity
C) They require manual operation at all times
D) They are immune to hacking
✅ Answer: A) Remote attackers can manipulate critical infrastructure
📌 Explanation: IoT-connected ICS devices (e.g., power grids, water systems) can be compromised remotely, leading to severe disruptions.
118. What makes “Zero-Day Vulnerabilities” in IoT devices particularly dangerous?
A) No security patches exist when they are discovered
B) They are easy to fix
C) They only affect older devices
D) They are publicly documented
✅ Answer: A) No security patches exist when they are discovered
📌 Explanation: Zero-day vulnerabilities are unknown to vendors, leaving IoT devices unprotected until a patch is developed.
119. Why is “Over-the-Air (OTA) Updates” a security risk for IoT devices?
A) If not properly secured, attackers can inject malicious firmware remotely
B) They improve device security
C) They require strong passwords
D) They encrypt all data
✅ Answer: A) If not properly secured, attackers can inject malicious firmware remotely
📌 Explanation: Unsecured OTA updates allow attackers to install malicious firmware, taking full control of IoT devices.
120. What is a key risk of using IoT devices with weak API authentication?
A) Attackers can bypass authentication and control devices remotely
B) It increases device battery life
C) It prevents unauthorized access
D) It improves network efficiency
✅ Answer: A) Attackers can bypass authentication and control devices remotely
📌 Explanation: Weak API authentication allows attackers to send unauthorized commands, potentially compromising the device and network.
121. What is an IoT botnet primarily used for?
A) Launching large-scale DDoS attacks
B) Speeding up IoT connections
C) Enhancing device security
D) Preventing unauthorized access
✅ Answer: A) Launching large-scale DDoS attacks
📌 Explanation: Compromised IoT devices in botnets can be used for DDoS attacks, spam distribution, and credential stuffing.
122. What vulnerability does “JTAG Debugging Interface” introduce in IoT devices?
A) It allows attackers to extract firmware and bypass security controls
B) It strengthens encryption
C) It prevents unauthorized access
D) It eliminates the need for authentication
✅ Answer: A) It allows attackers to extract firmware and bypass security controls
📌 Explanation: JTAG interfaces provide direct hardware access, making it possible for attackers to modify firmware and extract sensitive data.
123. What makes IoT routers a high-value target for hackers?
A) They serve as central points for traffic interception and attacks
B) They have limited storage capacity
C) They use strong encryption by default
D) They prevent malware infections
✅ Answer: A) They serve as central points for traffic interception and attacks
📌 Explanation: Compromising an IoT router allows attackers to intercept network traffic, launch attacks, and spread malware.
124. What is the purpose of “IoT Device Isolation”?
A) To separate IoT devices from critical networks to prevent lateral movement attacks
B) To improve battery life
C) To allow all devices to communicate freely
D) To disable encryption
✅ Answer: A) To separate IoT devices from critical networks to prevent lateral movement attacks
📌 Explanation: Network isolation ensures that IoT devices cannot be used as entry points to compromise other critical systems.
125. What is the impact of a “Side-Channel Attack” on IoT cryptographic processes?
A) Attackers can extract cryptographic keys by analyzing power consumption and timing variations
B) It strengthens encryption
C) It prevents unauthorized access
D) It speeds up device authentication
✅ Answer: A) Attackers can extract cryptographic keys by analyzing power consumption and timing variations
📌 Explanation: Side-channel attacks exploit power usage, electromagnetic leaks, and timing patterns to extract sensitive information.
126. What is a common weakness in IoT biometric authentication systems?
A) Biometric data cannot be changed once compromised
B) They provide stronger security than passwords
C) They automatically update encryption keys
D) They prevent all hacking attempts
✅ Answer: A) Biometric data cannot be changed once compromised
📌 Explanation: Unlike passwords, biometric data (fingerprints, retina scans) cannot be reset, making compromised data a permanent risk.
127. Why is “IoT Supply Chain Security” crucial?
A) Compromised components can introduce backdoors before deployment
B) It reduces device cost
C) It speeds up firmware updates
D) It eliminates vulnerabilities
✅ Answer: A) Compromised components can introduce backdoors before deployment
📌 Explanation: Supply chain attacks involve compromising IoT components before devices even reach consumers, making detection difficult.
128. What is a “Bootkit Attack” on IoT devices?
A) Malware that infects the bootloader to persist even after a device reset
B) A software update mechanism
C) A network configuration method
D) A way to increase encryption strength
✅ Answer: A) Malware that infects the bootloader to persist even after a device reset
📌 Explanation: Bootkits modify the bootloader, ensuring that malware remains active even after factory resets.
129. How can “Digital Twin” technology improve IoT security?
A) By simulating real IoT devices to test for vulnerabilities before deployment
B) By disabling encryption
C) By blocking firmware updates
D) By reducing battery consumption
✅ Answer: A) By simulating real IoT devices to test for vulnerabilities before deployment
📌 Explanation: Digital twins replicate IoT environments, allowing security teams to detect vulnerabilities before real-world deployment.
130. Why is “Fog Computing” a potential security concern in IoT networks?
A) Edge nodes process and store data locally, making them high-value attack targets
B) It eliminates encryption needs
C) It prevents firmware updates
D) It blocks unauthorized access automatically
✅ Answer: A) Edge nodes process and store data locally, making them high-value attack targets
📌 Explanation: Fog computing processes data at the network edge, which can expose sensitive data to local security risks.
131. What is a major concern of “Rogue IoT Devices” in an enterprise environment?
A) They can introduce security vulnerabilities by operating without IT approval
B) They reduce power consumption
C) They automatically update encryption keys
D) They prevent unauthorized access
✅ Answer: A) They can introduce security vulnerabilities by operating without IT approval
📌 Explanation: Unapproved IoT devices can be added to networks, creating unmonitored attack vectors.
132. What is a “Device Spoofing” attack in IoT?
A) When an attacker impersonates a legitimate IoT device to gain unauthorized access
B) When an IoT device automatically resets itself
C) When a device encrypts all traffic
D) When an IoT device speeds up its processing
✅ Answer: A) When an attacker impersonates a legitimate IoT device to gain unauthorized access
📌 Explanation: Device spoofing allows attackers to impersonate trusted devices, enabling unauthorized network access or data theft.
133. Why is “weak session management” a security issue in IoT?
A) Attackers can hijack active sessions to gain control of devices
B) It improves battery life
C) It speeds up authentication
D) It reduces processing power usage
✅ Answer: A) Attackers can hijack active sessions to gain control of devices
📌 Explanation: Weak session management allows session hijacking attacks, where attackers gain control over IoT sessions.
134. What security risk arises from the use of “third-party libraries” in IoT firmware?
A) Vulnerabilities in outdated or insecure libraries can be exploited by attackers
B) It improves encryption
C) It prevents unauthorized access
D) It enhances device speed
✅ Answer: A) Vulnerabilities in outdated or insecure libraries can be exploited by attackers
📌 Explanation: Third-party libraries may contain known vulnerabilities, making IoT devices susceptible to exploitation.
135. What is an “IoT Worm” in cybersecurity?
A) A self-replicating malware that spreads between IoT devices without user interaction
B) A firmware update process
C) A method for encrypting device storage
D) A type of authentication mechanism
✅ Answer: A) A self-replicating malware that spreads between IoT devices without user interaction
📌 Explanation: IoT worms exploit device vulnerabilities to spread automatically across networks, compromising multiple devices.
136. Why is “MQTT Protocol” commonly targeted in IoT attacks?
A) It lacks built-in encryption and authentication by default
B) It is too slow for attackers to use
C) It automatically blocks unauthorized access
D) It prevents network breaches
✅ Answer: A) It lacks built-in encryption and authentication by default
📌 Explanation: MQTT, a lightweight messaging protocol for IoT, does not enforce encryption, making it an attractive target for attacks.
137. What is the impact of “malicious firmware updates” in IoT security?
A) Attackers can take full control of the device by installing backdoors
B) It improves encryption strength
C) It speeds up device performance
D) It prevents unauthorized access
✅ Answer: A) Attackers can take full control of the device by installing backdoors
📌 Explanation: Malicious firmware updates allow attackers to inject malware or create persistent backdoors for remote control.
138. How can “5G-enabled IoT devices” introduce new security threats?
A) Increased connectivity expands the attack surface
B) 5G automatically encrypts all traffic
C) IoT devices with 5G consume more power
D) 5G prevents malware infections
✅ Answer: A) Increased connectivity expands the attack surface
📌 Explanation: 5G networks enable more connected devices, increasing the risk of DDoS attacks and data breaches.
139. What is a common vulnerability in IoT “wearable devices”?
A) Lack of encryption for transmitted health data
B) Excessive battery usage
C) Overuse of biometric authentication
D) Automatic firmware updates
✅ Answer: A) Lack of encryption for transmitted health data
📌 Explanation: Wearable IoT devices often transmit sensitive data without strong encryption, exposing it to attackers.
140. What is the role of “AI-driven anomaly detection” in IoT security?
A) It identifies unusual behavior in device activity to detect potential threats
B) It increases IoT device speed
C) It disables encryption
D) It prevents firmware updates
✅ Answer: A) It identifies unusual behavior in device activity to detect potential threats
📌 Explanation: AI-powered anomaly detection analyzes IoT behavior to identify potential security threats in real time.
141. How can “DNS Tunneling” be used in an IoT attack?
A) It hides malicious traffic inside DNS queries
B) It speeds up network connections
C) It improves IoT battery performance
D) It prevents firmware exploitation
✅ Answer: A) It hides malicious traffic inside DNS queries
📌 Explanation: DNS tunneling is used to bypass security controls by embedding malicious payloads within DNS traffic.
142. Why is “Blockchain Technology” being considered for IoT security?
A) It enhances data integrity and device authentication
B) It disables unauthorized devices automatically
C) It speeds up processing power
D) It prevents power consumption issues
✅ Answer: A) It enhances data integrity and device authentication
📌 Explanation: Blockchain can provide a secure, immutable ledger for IoT transactions and authentication, reducing fraud risks.
143. What is a “BrickerBot” attack?
A) Malware that permanently damages IoT devices, rendering them useless
B) A security protocol for IoT devices
C) A method of improving encryption
D) A way to optimize IoT battery life
✅ Answer: A) Malware that permanently damages IoT devices, rendering them useless
📌 Explanation: BrickerBot malware executes “permanent denial-of-service” (PDoS) attacks, corrupting IoT device firmware.
144. Why is “IoT Endpoint Security” critical in enterprise environments?
A) It protects network-connected devices from unauthorized access and cyber threats
B) It increases device speed
C) It reduces power consumption
D) It prevents automatic firmware updates
✅ Answer: A) It protects network-connected devices from unauthorized access and cyber threats
📌 Explanation: IoT endpoints (smart devices, sensors, controllers) require strong security to prevent breaches and lateral movement attacks.
145. What makes “smart thermostats” a potential IoT security risk?
A) Weak authentication and remote access vulnerabilities
B) Limited battery life
C) Excessive data storage
D) Inability to connect to the cloud
✅ Answer: A) Weak authentication and remote access vulnerabilities
📌 Explanation: Hackers can exploit weak authentication in smart thermostats to control settings, disrupt systems, or gain network access.
146. What IoT security measure can prevent unauthorized remote access?
A) Disabling default open ports and enforcing strong authentication
B) Using public Wi-Fi for all connections
C) Keeping all devices on the same network
D) Allowing hardcoded credentials
✅ Answer: A) Disabling default open ports and enforcing strong authentication
📌 Explanation: Closing unused ports and enforcing strong authentication reduces the risk of remote IoT attacks.
147. What is a primary risk of IoT devices storing sensitive data locally without encryption?
A) Attackers can extract the data if they gain physical or remote access to the device
B) It improves device processing speed
C) It enhances data recovery capabilities
D) It prevents unauthorized access
✅ Answer: A) Attackers can extract the data if they gain physical or remote access to the device
📌 Explanation: Unencrypted local storage makes IoT devices an easy target for attackers looking to steal credentials, logs, or sensitive information.
148. How does an “IoT Rootkit” attack work?
A) It embeds malicious code deep into the device firmware, making it difficult to detect and remove
B) It speeds up device performance
C) It forces the device to reboot continuously
D) It improves network encryption
✅ Answer: A) It embeds malicious code deep into the device firmware, making it difficult to detect and remove
📌 Explanation: Rootkits hide inside firmware or the operating system, allowing attackers to maintain persistent access and control over the IoT device.
149. What is a common weakness in IoT smart home hubs?
A) Weak authentication mechanisms and excessive permissions for connected devices
B) Too many firmware updates
C) High processing power usage
D) Limited storage capacity
✅ Answer: A) Weak authentication mechanisms and excessive permissions for connected devices
📌 Explanation: Smart home hubs often act as a central control point for multiple IoT devices, and weak security settings can expose the entire network.
150. How can attackers exploit “predictable IoT device identifiers”?
A) By identifying and targeting specific devices for attacks
B) By encrypting all device communications
C) By improving device efficiency
D) By forcing automatic software updates
✅ Answer: A) By identifying and targeting specific devices for attacks
📌 Explanation: Devices with predictable identifiers (e.g., sequential serial numbers) allow attackers to easily locate and target them for exploitation.
151. What is an effective way to secure IoT voice assistants from unauthorized access?
A) Disabling wake-word activation when not in use and using strong authentication
B) Keeping them always connected to public networks
C) Allowing all applications to access voice data
D) Using only factory default settings
✅ Answer: A) Disabling wake-word activation when not in use and using strong authentication
📌 Explanation: Voice assistants can be hacked using adversarial AI techniques, so limiting always-on activation and securing access settings helps mitigate risks.
152. Why are “orphaned IoT devices” a security concern?
A) They remain connected to networks even after they are no longer in use, creating attack vectors
B) They automatically delete their stored data
C) They prevent unauthorized access
D) They use strong encryption by default
✅ Answer: A) They remain connected to networks even after they are no longer in use, creating attack vectors
📌 Explanation: IoT devices that are not properly decommissioned can become entry points for cyberattacks if left unpatched and online.
153. What is the primary goal of “IoT Device Hardening”?
A) Reducing vulnerabilities by implementing strict security controls
B) Increasing device power consumption
C) Disabling encryption to improve speed
D) Allowing open access to all network ports
✅ Answer: A) Reducing vulnerabilities by implementing strict security controls
📌 Explanation: Device hardening includes removing default credentials, closing unnecessary ports, and enforcing encryption to reduce attack risks.
154. What is a risk of using default “Wi-Fi Protected Setup (WPS)” on IoT devices?
A) Attackers can exploit WPS PIN vulnerabilities to gain unauthorized network access
B) It prevents IoT devices from connecting
C) It improves network encryption
D) It ensures the device cannot be hacked
✅ Answer: A) Attackers can exploit WPS PIN vulnerabilities to gain unauthorized network access
📌 Explanation: WPS PIN brute-force attacks allow hackers to bypass WPA2 encryption and gain access to Wi-Fi networks.
155. Why should IoT devices be placed in a “dedicated VLAN” within a network?
A) To isolate them from critical business systems and limit lateral movement attacks
B) To increase battery life
C) To make it easier for all devices to communicate freely
D) To disable network encryption
✅ Answer: A) To isolate them from critical business systems and limit lateral movement attacks
📌 Explanation: Placing IoT devices in separate VLANs reduces the risk of network-wide compromises in case an IoT device is breached.
156. What is a “Packet Sniffing Attack” in the context of IoT devices?
A) An attacker captures and analyzes network traffic to steal sensitive information
B) An IoT device detecting nearby threats
C) A firmware update mechanism
D) A type of error logging
✅ Answer: A) An attacker captures and analyzes network traffic to steal sensitive information
📌 Explanation: Packet sniffing allows hackers to intercept unencrypted IoT data, potentially exposing sensitive commands and credentials.
157. How does “Geo-Fencing” improve IoT security?
A) It restricts device access and functionality based on physical location
B) It automatically encrypts all data
C) It improves device performance
D) It prevents malware infections
✅ Answer: A) It restricts device access and functionality based on physical location
📌 Explanation: Geo-fencing limits IoT device operations based on GPS or IP locations, helping prevent unauthorized remote access.
158. Why are “IoT Edge Devices” a high-value target for attackers?
A) They process and store critical data locally, making them vulnerable to compromise
B) They consume excessive power
C) They are never connected to the internet
D) They prevent unauthorized access by default
✅ Answer: A) They process and store critical data locally, making them vulnerable to compromise
📌 Explanation: IoT edge devices store and process sensitive data at the edge of the network, making them a prime target for attackers.
159. How does “Time-of-Check to Time-of-Use (TOCTOU)” impact IoT security?
A) It creates a race condition where security checks are bypassed before execution
B) It speeds up authentication processes
C) It prevents unauthorized access
D) It enhances device encryption
✅ Answer: A) It creates a race condition where security checks are bypassed before execution
📌 Explanation: TOCTOU attacks exploit timing inconsistencies between checking security conditions and executing commands, leading to potential exploits.
160. Why should IoT devices avoid connecting to “public Wi-Fi networks”?
A) Attackers can perform MITM (Man-in-the-Middle) attacks to intercept and manipulate traffic
B) It improves device battery life
C) It increases network speed
D) It eliminates the need for authentication
✅ Answer: A) Attackers can perform MITM (Man-in-the-Middle) attacks to intercept and manipulate traffic
📌 Explanation: Public Wi-Fi networks are often unsecured, allowing attackers to intercept, manipulate, or steal IoT data using MITM attacks.
161. What is the primary risk of using IoT devices with “hardcoded backdoors”?
A) Attackers can gain unauthorized access without user intervention
B) It improves device efficiency
C) It strengthens encryption
D) It prevents unauthorized access
✅ Answer: A) Attackers can gain unauthorized access without user intervention
📌 Explanation: Hardcoded backdoors are pre-installed access points that allow attackers to exploit devices without needing credentials.
162. Why is “SNMP (Simple Network Management Protocol) v1 and v2” considered insecure for IoT devices?
A) They transmit data in plaintext without encryption
B) They increase device battery consumption
C) They prevent unauthorized access
D) They improve device security
✅ Answer: A) They transmit data in plaintext without encryption
📌 Explanation: SNMP v1 and v2 lack encryption, allowing attackers to intercept and manipulate management commands on IoT devices.
163. What is a significant risk of using “default manufacturer certificates” in IoT devices?
A) Attackers can use publicly available certificates to impersonate legitimate devices
B) It speeds up authentication
C) It prevents network attacks
D) It strengthens encryption
✅ Answer: A) Attackers can use publicly available certificates to impersonate legitimate devices
📌 Explanation: Default certificates are often shared across multiple devices, making them an easy target for impersonation attacks.
164. How do “cross-site WebSocket hijacking” attacks impact IoT security?
A) Attackers can take control of IoT devices by hijacking WebSocket communications
B) They disable encryption
C) They prevent device authentication
D) They increase network performance
✅ Answer: A) Attackers can take control of IoT devices by hijacking WebSocket communications
📌 Explanation: Cross-site WebSocket hijacking allows attackers to intercept and manipulate real-time communication between IoT devices and web applications.
165. Why are “IoT surveillance cameras” frequently targeted by cybercriminals?
A) Many have weak authentication and open ports accessible over the internet
B) They consume too much power
C) They encrypt all video feeds
D) They require biometric authentication
✅ Answer: A) Many have weak authentication and open ports accessible over the internet
📌 Explanation: Unsecured IoT cameras with default passwords and open ports are easy targets for hackers to spy on users or use them in botnets.
166. What is the risk of “remote shell access” left open on IoT devices?
A) Attackers can execute arbitrary commands remotely
B) It improves device performance
C) It prevents unauthorized access
D) It increases encryption strength
✅ Answer: A) Attackers can execute arbitrary commands remotely
📌 Explanation: Leaving remote shell access enabled (e.g., SSH or Telnet) with weak security settings allows attackers to take full control of an IoT device.
167. How can “automated IoT botnet scanning tools” be used maliciously?
A) Attackers use them to discover and exploit vulnerable IoT devices at scale
B) They improve device security
C) They increase processing speed
D) They prevent brute-force attacks
✅ Answer: A) Attackers use them to discover and exploit vulnerable IoT devices at scale
📌 Explanation: Botnet scanning tools allow attackers to identify and infect IoT devices globally, often recruiting them into DDoS botnets.
168. What is an effective way to prevent “IoT device enumeration” by attackers?
A) Disabling unnecessary services and hiding device identifiers
B) Keeping factory default settings
C) Enabling public access to APIs
D) Allowing all open network ports
✅ Answer: A) Disabling unnecessary services and hiding device identifiers
📌 Explanation: Attackers use enumeration techniques to gather information about device models, firmware versions, and open ports, which can be prevented by hardening devices.
169. Why is “multi-tenancy in cloud-connected IoT devices” a security risk?
A) A compromised tenant can impact multiple IoT users on the same cloud infrastructure
B) It improves data sharing
C) It prevents unauthorized access
D) It encrypts all stored data
✅ Answer: A) A compromised tenant can impact multiple IoT users on the same cloud infrastructure
📌 Explanation: Cloud-based IoT platforms hosting multiple users can be compromised if one tenant’s security is breached, affecting others.
170. How do “side-channel attacks” threaten IoT cryptographic security?
A) Attackers extract encryption keys by analyzing device power usage or timing variations
B) They improve data encryption
C) They prevent unauthorized access
D) They block firmware updates
✅ Answer: A) Attackers extract encryption keys by analyzing device power usage or timing variations
📌 Explanation: Side-channel attacks use electromagnetic emissions, timing patterns, or power consumption to steal encryption keys.
171. What is the impact of “poor IoT network segmentation”?
A) Attackers can move laterally across networks once they compromise a single device
B) It prevents unauthorized access
C) It improves encryption strength
D) It reduces device response time
✅ Answer: A) Attackers can move laterally across networks once they compromise a single device
📌 Explanation: Without network segmentation, a compromised IoT device can allow an attacker to breach the entire network.
172. What security risk is posed by “insecure IoT voice recognition systems”?
A) Attackers can use recorded or synthesized voices to bypass authentication
B) They encrypt all conversations
C) They require multi-factor authentication
D) They prevent unauthorized access
✅ Answer: A) Attackers can use recorded or synthesized voices to bypass authentication
📌 Explanation: Voice authentication systems can be tricked using deepfake or recorded voices, leading to unauthorized access.
173. Why is “publicly exposed IoT debug interfaces” a serious security issue?
A) Attackers can use them to manipulate device functions or extract sensitive data
B) They speed up device processing
C) They prevent unauthorized access
D) They improve firmware updates
✅ Answer: A) Attackers can use them to manipulate device functions or extract sensitive data
📌 Explanation: Exposed debugging interfaces (e.g., JTAG, UART) can be used to gain full control over an IoT device.
174. What is a “rollback attack” in IoT security?
A) Downgrading a device to a previous vulnerable firmware version to exploit known flaws
B) Forcing a device to reboot repeatedly
C) Encrypting device storage
D) Speeding up network authentication
✅ Answer: A) Downgrading a device to a previous vulnerable firmware version to exploit known flaws
📌 Explanation: Rollback attacks exploit firmware downgrade vulnerabilities, allowing attackers to restore old, insecure versions.
175. How can attackers exploit “insecure IoT proximity authentication”?
A) By using replay attacks to mimic legitimate users
B) By encrypting all data
C) By using only strong passwords
D) By preventing device connections
✅ Answer: A) By using replay attacks to mimic legitimate users
📌 Explanation: Insecure proximity authentication can be bypassed using replay attacks, where previous authentication signals are captured and replayed.
176. What is the risk of using “default SNMP community strings” in IoT devices?
A) Attackers can access and modify device settings remotely
B) It improves IoT device response time
C) It prevents unauthorized access
D) It increases encryption strength
✅ Answer: A) Attackers can access and modify device settings remotely
📌 Explanation: Default SNMP (Simple Network Management Protocol) community strings are often publicly known, allowing attackers to remotely query and manipulate device settings.
177. What is the impact of “unencrypted MQTT communication” in IoT security?
A) Attackers can intercept and modify device commands or data
B) It prevents unauthorized access
C) It enhances data transmission speed
D) It blocks network-based attacks
✅ Answer: A) Attackers can intercept and modify device commands or data
📌 Explanation: MQTT (Message Queuing Telemetry Transport) is widely used in IoT but lacks built-in encryption, making it susceptible to eavesdropping and command injection.
178. Why are “insecure bootloaders” a critical IoT vulnerability?
A) They allow attackers to install malicious firmware
B) They improve device processing power
C) They prevent unauthorized access
D) They increase device speed
✅ Answer: A) They allow attackers to install malicious firmware
📌 Explanation: Insecure bootloaders do not verify firmware integrity, allowing attackers to flash malicious firmware onto IoT devices.
179. What is a risk associated with “IoT mesh networks”?
A) A single compromised node can compromise the entire network
B) It reduces network congestion
C) It prevents unauthorized access
D) It increases encryption strength
✅ Answer: A) A single compromised node can compromise the entire network
📌 Explanation: IoT mesh networks allow devices to communicate directly, meaning a compromised node can spread malware or be used to intercept traffic.
180. What type of attack can be executed by exploiting “insecure inter-device communication” in IoT?
A) Man-in-the-Middle (MITM) attack
B) SQL Injection attack
C) Cross-site scripting (XSS) attack
D) Buffer Overflow attack
✅ Answer: A) Man-in-the-Middle (MITM) attack
📌 Explanation: Insecure communication between IoT devices (e.g., lack of encryption or authentication) allows MITM attacks, where an attacker intercepts and manipulates device communication.
181. What security issue arises from using “self-signed SSL certificates” in IoT devices?
A) Attackers can conduct MITM attacks by impersonating trusted devices
B) It improves device authentication speed
C) It prevents brute-force attacks
D) It enhances firmware security
✅ Answer: A) Attackers can conduct MITM attacks by impersonating trusted devices
📌 Explanation: Self-signed certificates are not verified by trusted authorities, making it easy for attackers to spoof trusted IoT connections.
182. Why should “Telnet access” be disabled on IoT devices?
A) It transmits data in plaintext, making it vulnerable to interception
B) It enhances encryption strength
C) It prevents unauthorized access
D) It speeds up network performance
✅ Answer: A) It transmits data in plaintext, making it vulnerable to interception
📌 Explanation: Telnet does not use encryption, meaning passwords and commands can be intercepted by attackers on the network.
183. What is the risk of using “deprecated cryptographic algorithms” in IoT devices?
A) Attackers can easily break encryption and compromise data
B) It improves device efficiency
C) It prevents unauthorized access
D) It speeds up authentication
✅ Answer: A) Attackers can easily break encryption and compromise data
📌 Explanation: Older cryptographic algorithms (e.g., MD5, SHA-1, RC4) have known vulnerabilities, making encrypted IoT data easy to decrypt.
184. What vulnerability can be exploited when IoT devices “expose debug ports” (e.g., UART, JTAG)?
A) Attackers can gain low-level access to the device and modify firmware
B) It speeds up device authentication
C) It prevents unauthorized access
D) It increases encryption strength
✅ Answer: A) Attackers can gain low-level access to the device and modify firmware
📌 Explanation: Exposed debug ports (UART, JTAG) allow attackers to bypass authentication, extract data, or install malicious firmware.
185. Why are “static encryption keys” a major security risk in IoT devices?
A) If one device’s key is compromised, all devices using the same key become vulnerable
B) It prevents unauthorized access
C) It improves encryption speed
D) It ensures firmware integrity
✅ Answer: A) If one device’s key is compromised, all devices using the same key become vulnerable
📌 Explanation: Static keys (hardcoded in multiple devices) allow attackers to decrypt traffic from any compromised device, leading to mass compromise.
186. How does “certificate pinning” improve IoT security?
A) It prevents attackers from using fake SSL certificates in MITM attacks
B) It speeds up device encryption
C) It prevents unauthorized access
D) It improves device battery life
✅ Answer: A) It prevents attackers from using fake SSL certificates in MITM attacks
📌 Explanation: Certificate pinning ensures that only specific trusted certificates are accepted, reducing the risk of spoofing and MITM attacks.
187. What is a major concern with “IoT cloud-based control panels”?
A) A single breach can expose all connected IoT devices
B) It improves authentication speed
C) It prevents unauthorized access
D) It enhances encryption
✅ Answer: A) A single breach can expose all connected IoT devices
📌 Explanation: IoT cloud control panels centralize device management, meaning a single breach could compromise an entire IoT ecosystem.
188. Why is “automatic pairing” of Bluetooth IoT devices a security risk?
A) It allows unauthorized devices to connect without user approval
B) It prevents unauthorized access
C) It improves device performance
D) It enhances data encryption
✅ Answer: A) It allows unauthorized devices to connect without user approval
📌 Explanation: If Bluetooth pairing is automatic, attackers nearby can exploit vulnerabilities to pair with the device and send malicious commands.
189. What is a primary reason why “IoT data integrity validation” is necessary?
A) To prevent attackers from tampering with data in transit or storage
B) To increase device speed
C) To reduce encryption overhead
D) To prevent firmware updates
✅ Answer: A) To prevent attackers from tampering with data in transit or storage
📌 Explanation: Without integrity validation (e.g., cryptographic hashing, digital signatures), attackers could modify IoT data, leading to security risks.
190. What is a “broadcast storm” in an IoT network?
A) An excessive number of broadcast packets that overloads the network
B) A form of strong encryption
C) A technique used to prevent hacking
D) A mechanism to speed up IoT processing
✅ Answer: A) An excessive number of broadcast packets that overloads the network
📌 Explanation: A broadcast storm occurs when too many broadcast messages flood an IoT network, causing congestion, latency, and possible denial-of-service.
191. Why is “IoT device cloning” a significant security risk?
A) Attackers can create duplicate devices to intercept or manipulate communications
B) It speeds up device processing
C) It prevents unauthorized access
D) It improves encryption strength
✅ Answer: A) Attackers can create duplicate devices to intercept or manipulate communications
📌 Explanation: IoT device cloning allows attackers to create an exact replica of a legitimate device, intercept data, or manipulate network traffic.
192. What is a primary risk of “open IoT APIs” with no authentication?
A) Attackers can send malicious requests to control or extract data from devices
B) It improves device response time
C) It prevents unauthorized access
D) It enhances encryption
✅ Answer: A) Attackers can send malicious requests to control or extract data from devices
📌 Explanation: Exposed APIs without authentication allow attackers to interact with devices, modify settings, or exfiltrate data.
193. Why should IoT firmware updates be downloaded from trusted sources only?
A) Malicious firmware updates can install backdoors or disrupt device functionality
B) It speeds up device boot time
C) It improves encryption strength
D) It reduces device processing power
✅ Answer: A) Malicious firmware updates can install backdoors or disrupt device functionality
📌 Explanation: Firmware downloaded from untrusted sources may be compromised with malware, allowing attackers to control the device remotely.
194. How do “race conditions” impact IoT device security?
A) Attackers exploit timing issues to bypass security checks and execute unauthorized actions
B) It speeds up device authentication
C) It prevents unauthorized access
D) It increases encryption strength
✅ Answer: A) Attackers exploit timing issues to bypass security checks and execute unauthorized actions
📌 Explanation: Race conditions occur when multiple processes execute simultaneously, allowing attackers to manipulate execution flow and bypass security mechanisms.
195. Why is “weak authorization” a major issue in IoT ecosystems?
A) Unauthorized users can gain access to sensitive functions or data
B) It speeds up encryption
C) It prevents device pairing
D) It enhances battery life
✅ Answer: A) Unauthorized users can gain access to sensitive functions or data
📌 Explanation: Weak authorization controls allow attackers to access sensitive IoT device functions, such as changing settings or extracting data.
196. What is a risk of using “plaintext credential storage” in IoT devices?
A) Attackers can extract passwords or API keys if they gain access to device storage
B) It improves device security
C) It prevents unauthorized access
D) It speeds up authentication
✅ Answer: A) Attackers can extract passwords or API keys if they gain access to device storage
📌 Explanation: Storing credentials in plaintext makes them easily retrievable by attackers, leading to unauthorized access and data breaches.
197. Why should IoT devices implement “default deny” access controls?
A) To ensure that only explicitly allowed actions and users can interact with the device
B) To improve battery life
C) To increase encryption speed
D) To prevent firmware updates
✅ Answer: A) To ensure that only explicitly allowed actions and users can interact with the device
📌 Explanation: “Default deny” policies block all access unless explicitly permitted, reducing unauthorized access risks.
198. What is the primary issue with “IoT devices using default admin credentials”?
A) Attackers can use publicly known passwords to gain unauthorized access
B) It increases encryption strength
C) It speeds up device performance
D) It prevents brute-force attacks
✅ Answer: A) Attackers can use publicly known passwords to gain unauthorized access
📌 Explanation: Many IoT devices ship with default admin credentials, which attackers can easily guess or find online.
199. Why is “IoT device fingerprinting” used by attackers?
A) To gather information about a device’s model, OS, and vulnerabilities before launching attacks
B) To encrypt all device data
C) To prevent unauthorized access
D) To improve network speed
✅ Answer: A) To gather information about a device’s model, OS, and vulnerabilities before launching attacks
📌 Explanation: Fingerprinting techniques allow attackers to identify specific IoT devices and target them with exploits tailored to their vulnerabilities.
200. What is a common weakness in “BLE (Bluetooth Low Energy) IoT security”?
A) Weak pairing mechanisms that allow attackers to intercept or hijack connections
B) It improves battery efficiency
C) It enhances encryption strength
D) It prevents unauthorized access
✅ Answer: A) Weak pairing mechanisms that allow attackers to intercept or hijack connections
📌 Explanation: Many BLE devices rely on insecure pairing methods, making them vulnerable to MITM and hijacking attacks.
201. How can “IoT device-side request forgery (DSRF)” be exploited?
A) Attackers manipulate IoT devices into sending malicious requests to backend servers
B) It speeds up device authentication
C) It prevents unauthorized access
D) It improves encryption strength
✅ Answer: A) Attackers manipulate IoT devices into sending malicious requests to backend servers
📌 Explanation: DSRF occurs when an attacker forces an IoT device to make unauthorized requests, potentially exposing sensitive data.
202. What is the impact of “insecure default configurations” in IoT devices?
A) They expose devices to unnecessary risks and potential exploits
B) They improve device performance
C) They prevent unauthorized access
D) They enhance encryption
✅ Answer: A) They expose devices to unnecessary risks and potential exploits
📌 Explanation: Default configurations often include open ports, weak passwords, or disabled security settings, making IoT devices vulnerable.
203. How do attackers exploit “IoT session hijacking”?
A) By stealing active session tokens to gain unauthorized control of devices
B) By encrypting all data in transit
C) By forcing device updates
D) By improving network authentication
✅ Answer: A) By stealing active session tokens to gain unauthorized control of devices
📌 Explanation: IoT session hijacking involves stealing authentication tokens, allowing attackers to impersonate legitimate users.
204. What is the primary goal of “IoT honeypots” in cybersecurity?
A) To attract and study attackers’ techniques in a controlled environment
B) To speed up IoT device authentication
C) To prevent firmware updates
D) To improve encryption
✅ Answer: A) To attract and study attackers’ techniques in a controlled environment
📌 Explanation: IoT honeypots act as decoy systems, allowing researchers to analyze attacker behavior and develop better security defenses.
205. What is the main security concern of “IoT biometric authentication systems”?
A) Biometric data cannot be changed once compromised
B) It enhances password security
C) It prevents unauthorized access
D) It improves encryption strength
✅ Answer: A) Biometric data cannot be changed once compromised
📌 Explanation: Unlike passwords, biometric data (fingerprints, facial recognition) cannot be reset, making it a permanent risk if stolen.