10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CIoTSP exam has 100 questions and runs 2 hours.
These 10 free CIoTSP questions are organized by exam domain, so you can see how each part of the Certified Internet of Things Security Practitioner blueprint is tested. Reveal the answer and explanation under each question.
A company deploys thousands of IoT sensors with a web portal for device management. During a security review, an assessor finds that entering different usernames into the login page reveals whether an account exists. Which vulnerability is being demonstrated?
Correct answer: B - Account enumeration
An administrator is configuring access to an IoT cloud dashboard used by operations, maintenance, and security teams. Which design choice BEST follows secure access principles?
Correct answer: B - Use granular role-based access based on job responsibilities
A smart building controller accepts commands from a mobile application. A tester discovers that a user can change the device ID in a request URL and access another customer's device information. Which issue should the security team address?
Correct answer: A - Unsecure direct object reference
A security analyst reviews IoT device logs and discovers that administrators can make sensitive configuration changes without any record of who performed the action. Which capability is missing?
Correct answer: B - Accounting
An IoT gateway is exposed to the internet and has several unused network services listening on open ports. What is the MOST appropriate security improvement?
Correct answer: B - Apply port control to limit unnecessary exposed services
A fleet of IoT devices becomes unavailable after receiving a massive volume of malformed network requests. Which attack type is MOST consistent with this event?
Correct answer: A - Denial of service through network-device fuzzing
A security engineer is reviewing protection requirements for temperature sensor data. Data is currently being transmitted from remote sensors to a cloud platform without protection. Which security objective should be addressed first?
Correct answer: A - Encrypt data in motion
An organization stores encrypted IoT records but allows an unauthorized application to access the decrypted information while it is being processed. Which data state is primarily affected?
Correct answer: C - Data in use
A consumer IoT manufacturer collects precise location, usage patterns, and personal identifiers from every customer even though only device health information is needed for support. Which privacy principle is being violated?
Correct answer: A - Collect only critical data
A company retains customer IoT records indefinitely because no deletion process has been established. Which privacy control should be implemented?
Correct answer: A - A data-retention policy
The CIoTSP exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more CIoTSP questions with explanations.
Continue in the free practice test →
View plans