I85PREP
⌘ K
CertNexus CET study materials
CertNexus CET study resources

CertNexus CET practice questions

One question at a time. Build your CertNexus CET understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity

A security analyst is mapping the phases of a penetration test to the MITRE ATT&CK enterprise matrix. Which ATT&CK tactic describes an adversary attempting to gain initial network access through a public-facing application vulnerability?

  1. Execution
  2. Privilege Escalation
  3. Persistence
  4. Initial Access Correct answer.

Explanation

Initial Access is the ATT&CK tactic covering techniques that get an adversary a foothold in the target environment, such as exploiting a public-facing application or phishing. Execution covers running malicious code after access, Persistence covers maintaining a foothold, and Privilege Escalation covers obtaining higher permissions.

Question 2Cybersecurity

An organization wants to reduce the risk of successful credential-stuffing attacks against its customer portal. Which control most directly addresses this threat?

  1. Deploying a web application firewall in monitor-only mode
  2. Rotating the TLS certificate every 90 days
  3. Requiring multi-factor authentication at login Correct answer.
  4. Enforcing a maximum password length

Explanation

Credential stuffing succeeds when stolen username/password pairs are replayed against a service, so adding a second authentication factor breaks the attack even when the password is valid. Password length limits and certificate rotation do not stop replayed valid credentials, and a monitor-only WAF does not block the attempts.

Question 3Cybersecurity

Which activity best characterizes the reconnaissance phase of an authorized penetration test?

  1. Collecting publicly available DNS and employee information Correct answer.
  2. Exploiting a known vulnerability to obtain a shell
  3. Covering tracks by clearing event logs
  4. Establishing a covert command-and-control channel

Explanation

Reconnaissance gathers information about the target before exploitation, typically from open sources such as DNS records, job postings, and social media. Exploitation, command-and-control, and log clearing occur in later phases of an engagement.

Question 4Cybersecurity

What is the primary purpose of a risk register in an information security program?

  1. To record every packet that crosses the network perimeter
  2. To list employees who have completed security awareness training
  3. To store cryptographic keys used for data encryption
  4. To document identified risks with owners, ratings, and treatment decisions Correct answer.

Explanation

A risk register is the central record of identified risks, capturing attributes such as likelihood, impact, risk owner, and the chosen treatment (mitigate, transfer, avoid, or accept). It is a governance and tracking tool, not a key store, packet log, or training roster.

Question 5Cybersecurity

Which statement correctly describes the difference between symmetric and asymmetric encryption?

  1. Symmetric encryption uses a single shared key, while asymmetric encryption uses a public/private key pair Correct answer.
  2. Symmetric encryption uses a public/private key pair, while asymmetric encryption uses a single shared key
  3. Symmetric encryption cannot encrypt data at rest, while asymmetric encryption can encrypt any volume of data
  4. Symmetric encryption provides non-repudiation, while asymmetric encryption does not

Explanation

Symmetric algorithms such as AES use one shared secret key for both encryption and decryption, making them fast and suited to bulk data. Asymmetric algorithms such as RSA use a mathematically related public and private key pair and are typically used for key exchange and digital signatures.

Question 6Cybersecurity

A user receives an email that appears to come from the finance director and urgently requests a wire transfer to a new vendor. Which social engineering technique is being used?

  1. Tailgating
  2. Business email compromise Correct answer.
  3. Shoulder surfing
  4. Watering hole attack

Explanation

Business email compromise impersonates or compromises an executive or trusted party to trick staff into transferring funds or disclosing data. Tailgating and shoulder surfing are physical techniques, and a watering hole attack compromises a website the target is known to visit.

Question 7Cybersecurity

Which element of the CIA triad is most directly protected by maintaining regular, tested backups of critical data?

  1. Non-repudiation
  2. Integrity
  3. Confidentiality
  4. Availability Correct answer.

Explanation

Backups allow an organization to restore data and services after destruction, ransomware, or outage, which preserves availability. Integrity concerns accuracy and completeness of data, confidentiality concerns unauthorized disclosure, and non-repudiation concerns proving an action occurred.

Question 8Cybersecurity

What is the purpose of network segmentation in a security architecture?

  1. To eliminate the need for firewalls between internal systems
  2. To increase the broadcast domain size across all VLANs
  3. To limit lateral movement by restricting traffic between zones Correct answer.
  4. To encrypt all traffic using a single shared key

Explanation

Segmentation divides a network into zones with controlled traffic paths, so a compromise in one zone cannot freely reach others. This limits lateral movement and reduces blast radius; it complements rather than replaces firewalls and does not itself encrypt traffic.

Question 9Cybersecurity

An analyst reviewing logs sees repeated login attempts from a single IP address against many usernames with a small set of common passwords. Which attack is most consistent with this pattern?

  1. Password spraying Correct answer.
  2. SQL injection
  3. DNS tunneling
  4. Cross-site scripting

Explanation

Password spraying tries a few common passwords against many accounts to avoid lockout thresholds, which matches the observed pattern of many usernames and few passwords. SQL injection and XSS target web application inputs, and DNS tunneling exfiltrates data through DNS queries.

Question 10Cybersecurity

A company must comply with a regulation requiring that cardholder data be encrypted in transit over public networks. Which control satisfies this requirement?

  1. Hashing card numbers with SHA-256 before storage
  2. Storing data on an encrypted USB drive
  3. Requiring administrators to change passwords every 30 days
  4. Enforcing TLS 1.2 or higher for all external connections Correct answer.

Explanation

Encryption in transit requires a transport protocol such as TLS to protect data as it crosses public networks. Hashing is one-way and does not protect data in transit, encrypted removable media addresses data at rest, and password rotation is an authentication control.

Question 11Cybersecurity

During an incident, an analyst needs to determine whether an attacker moved from a compromised workstation to a database server. Which log source is most useful for this determination?

  1. Firewall egress logs showing blocked outbound traffic
  2. Authentication logs on the database server showing new logins from the workstation Correct answer.
  3. DHCP lease logs for the workstation
  4. Antivirus scan reports from the workstation

Explanation

Lateral movement appears as authentication or session activity from one internal host to another, so database server authentication logs revealing a new source host are the strongest evidence. Egress firewall logs, antivirus reports, and DHCP leases describe other aspects of the environment.

Question 12Cybersecurity

Which practice best mitigates the risk of a successful phishing email leading to account compromise?

  1. Requiring users to reuse a single strong password across systems
  2. Disabling email attachment scanning to improve delivery speed
  3. Blocking all external email at the gateway
  4. Combining security awareness training with phishing simulations and MFA Correct answer.

Explanation

Layered defenses reduce phishing success: training and simulations improve user recognition, while MFA limits the value of a captured password. Blocking all external mail is operationally unworkable, disabling scanning increases risk, and password reuse amplifies the impact of any single compromise.

Question 13Cybersecurity

An organization adopts a zero trust architecture. Which principle is most central to this model?

  1. Trusting all traffic that originates inside the corporate network perimeter
  2. Verifying every access request explicitly regardless of network location Correct answer.
  3. Relying solely on perimeter firewalls for access control
  4. Granting standing administrative privileges to reduce helpdesk tickets

Explanation

Zero trust removes implicit trust based on network location and requires explicit verification of every request using identity, device posture, and context. Perimeter-only defenses and standing privileges contradict the model's least-privilege and continuous-verification principles.

Question 14Cybersecurity

A vulnerability scanner reports a critical flaw in a public-facing web server. According to typical vulnerability management practice, what should happen first?

  1. Disable all logging on the server to reduce noise
  2. Validate the finding and assess exploitability and business impact Correct answer.
  3. Wait for the next quarterly patch cycle to bundle the fix
  4. Delete the scanner report to avoid audit findings

Explanation

Findings should be validated to rule out false positives, then prioritized by exploitability and business impact so remediation effort goes to the highest real risk. Deferring a critical public-facing flaw, hiding findings, or reducing logging all increase exposure.

Question 15Cybersecurity

Which hashing property is most important when storing user passwords?

  1. The hash should be salted and computed with a deliberately slow algorithm Correct answer.
  2. The hash output should be shorter than the input password
  3. The hash function should be fast and reversible with a shared key
  4. The hash should be identical for users who choose the same password

Explanation

Password storage requires a unique salt per user plus a slow, memory-hard algorithm such as bcrypt, scrypt, or Argon2 to resist rainbow tables and brute-force cracking. Fast hashes, reversible schemes, and identical outputs for identical passwords all weaken protection.

Question 16Cybersecurity

An administrator must choose a control to detect unauthorized changes to critical system files on a server. Which solution best fits this requirement?

  1. A network intrusion prevention system in inline mode
  2. A host-based antivirus signature update
  3. File integrity monitoring with baseline comparison Correct answer.
  4. Full-disk encryption with a TPM

Explanation

File integrity monitoring records cryptographic hashes of critical files and alerts when they diverge from the approved baseline, directly detecting unauthorized modification. Antivirus signatures target malware, network IPS inspects traffic, and disk encryption protects data at rest.

Question 17Cybersecurity

Which protocol should be used instead of Telnet for remote administration, and why?

  1. TFTP, because it uses a secure channel
  2. FTP, because it encrypts file transfers
  3. SSH, because it provides encrypted and authenticated sessions Correct answer.
  4. SNMPv1, because it encrypts management traffic

Explanation

Telnet transmits credentials and session data in cleartext, so SSH is the standard replacement because it encrypts the session and authenticates the server. FTP and TFTP are file transfer protocols without encryption, and SNMPv1 sends community strings in cleartext.

Question 18Cybersecurity

A security team wants to detect an attacker exfiltrating data over DNS. Which indicator is most relevant?

  1. Repeated failed SSH logins from internal hosts
  2. Increased HTTPS traffic to a known CDN
  3. Large volumes of TXT or NULL queries to a single unfamiliar domain Correct answer.
  4. A spike in NTP synchronization requests

Explanation

DNS tunneling often shows as unusually large or frequent TXT, NULL, or long subdomain queries to one domain, because data is encoded in query names and responses. Failed SSH logins indicate brute force, NTP spikes are time sync noise, and CDN traffic is normally legitimate.

Question 19Cybersecurity

Which statement about the difference between a vulnerability assessment and a penetration test is accurate?

  1. A vulnerability assessment proves exploitability, while a penetration test only enumerates findings
  2. Both are identical activities performed with the same tooling and reporting
  3. A penetration test is performed without authorization, while a vulnerability assessment requires a contract
  4. A vulnerability assessment identifies and prioritizes weaknesses, while a penetration test attempts to exploit them in a scoped engagement Correct answer.

Explanation

A vulnerability assessment enumerates and prioritizes weaknesses, often with scanners, while a penetration test goes further by attempting controlled exploitation within an agreed scope and rules of engagement. Both require authorization, and they differ in depth and objective.

Question 20Cybersecurity

An organization wants to reduce the impact of a ransomware outbreak on its file servers. Which combination of controls is most effective?

  1. A single perimeter firewall plus email filtering
  2. Offline or immutable backups plus network segmentation and least privilege Correct answer.
  3. Antivirus on workstations only plus quarterly password changes
  4. Full-disk encryption plus a longer password policy

Explanation

Ransomware impact is reduced by ensuring recoverability through offline or immutable backups, limiting spread through segmentation, and restricting the privileges that allow encryption of shared data. The other combinations address only partial aspects and leave recovery or lateral movement unaddressed.

Question 21Cybersecurity

A security analyst is reviewing an access control list and finds that a service account used by a backup application has domain administrator rights. What is the most significant risk?

  1. A compromise of the backup server yields control of the entire domain Correct answer.
  2. The account will expire and break the backup schedule
  3. Audit logs will record too many events
  4. The backup job will run more slowly than necessary

Explanation

Overprivileged service accounts violate least privilege, so compromise of the host running the account escalates directly to domain-wide control. Performance, expiry, and log volume are secondary concerns compared with this privilege escalation path.

Question 22Cybersecurity

A penetration tester discovers that an internal web application reflects user input into the page without encoding, and a script executes in the browser of another user. Which vulnerability class has been demonstrated?

  1. Stored cross-site scripting
  2. Reflected cross-site scripting Correct answer.
  3. Insecure deserialization
  4. Server-side request forgery

Explanation

Reflected XSS occurs when input from the current request is echoed into the response without encoding and executes in the victim's browser. Stored XSS persists the payload server-side, SSRF makes the server issue requests, and deserialization attacks abuse object reconstruction.

Question 23Cybersecurity

An organization uses a digital signature to verify the authenticity of a software update. Which key is used to verify the signature, and what does successful verification prove?

  1. A shared symmetric key, proving the update is confidential
  2. The recipient's private key, proving the recipient authorized the update
  3. The signer's private key, proving the signer kept the key secret
  4. The signer's public key, proving the update was signed by the holder of the corresponding private key and was not altered Correct answer.

Explanation

Signature verification uses the signer's public key to confirm that the signature was produced with the matching private key and that the content hash is unchanged. This provides integrity and authenticity, not confidentiality, and the recipient's key is not involved.

Question 24Cybersecurity

During a tabletop exercise, participants must decide the order of operations after discovering confirmed data theft. Which sequence best reflects accepted incident response practice?

  1. Recover services immediately, then notify regulators, then investigate scope
  2. Eradicate the threat, then contain affected systems, then identify the scope
  3. Contain affected systems, eradicate the threat, then recover and validate restored services Correct answer.
  4. Notify regulators, then restore from backup, then determine root cause

Explanation

Incident response generally moves from identification and containment to eradication, recovery, and lessons learned, with containment limiting further damage before removal. Restoring service or notifying before understanding scope risks recompromise and inaccurate reporting.

Question 25Cybersecurity

A security architect must select a control that detects unauthorized configuration drift on cloud infrastructure while enforcing approved baselines. Which approach best meets both detection and enforcement?

  1. Infrastructure as code with policy-as-code checks in the deployment pipeline Correct answer.
  2. Periodic manual review of console screenshots
  3. Enabling verbose logging on all resources
  4. Granting developers permanent administrator roles

Explanation

Policy-as-code evaluated in the pipeline prevents noncompliant resources from being deployed and continuously flags drift against the declared baseline, combining prevention with detection. Manual reviews are slow and error-prone, verbose logging alone does not enforce baselines, and permanent admin roles increase risk.

Question 26Cybersecurity

Which concept describes the assurance that data has not been altered in an unauthorized way, whether in storage or during transmission?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity is the property that data remains accurate and complete and has not been modified without authorization. Hashing and digital signatures are typical controls that support integrity verification.

Question 27Cybersecurity

An employee finds a USB flash drive in the office parking lot and plugs it into a corporate workstation to identify the owner. Which threat is most directly demonstrated by this action?

  1. Smishing that harvests data through text messages
  2. Tailgating that bypasses physical access controls
  3. Shoulder surfing that captures credentials on screen
  4. Baiting that exploits human curiosity to deliver malware Correct answer.

Explanation

Baiting is a social engineering technique in which an attacker leaves physical media such as a USB drive hoping a victim connects it, allowing malware to run. The exploit relies on curiosity rather than on technical flaws.

Question 28Cybersecurity

Which authentication factor category is represented by a hardware token that generates a time-based one-time code?

  1. Something you know
  2. Something you are
  3. Somewhere you are
  4. Something you have Correct answer.

Explanation

A hardware token is a physical object the user possesses, so it belongs to the something-you-have factor category. Time-based codes strengthen the factor but do not change its category.

Question 29Cybersecurity

Which security control type is a warning banner displayed before users log on to a system?

  1. Preventive
  2. Compensating
  3. Detective Correct answer.
  4. Corrective

Explanation

A login banner is a detective control because it is intended to deter and to record awareness of policy rather than to block access technically. It does not stop an action by itself.

Question 30Cybersecurity

A security administrator wants to ensure that stolen password hashes cannot be reused directly if an attacker obtains the password database. Which practice best addresses this goal?

  1. Applying a unique random salt to each password before hashing Correct answer.
  2. Encrypting the password database with a shared symmetric key
  3. Limiting failed login attempts on the authentication server
  4. Storing passwords using a fast general-purpose hash function

Explanation

A unique salt per password prevents attackers from reusing precomputed rainbow tables and ensures identical passwords do not produce identical hashes. Salting combined with a slow algorithm makes offline cracking far harder.

Question 31Cybersecurity

An organization wants to allow remote employees to access internal applications without exposing those applications directly to the internet. Which architecture best meets this requirement?

  1. Require connections through a VPN concentrator before reaching internal resources Correct answer.
  2. Enable split tunneling so only corporate traffic uses the tunnel
  3. Place the applications in the screened subnet with host firewalls
  4. Publish each internal application on a separate public IP address

Explanation

A VPN concentrator establishes an encrypted tunnel so remote users reach internal applications as if on the corporate network, without direct internet exposure. Access can then be restricted by authentication and authorization policy.

Question 32Cybersecurity

A security analyst is correlating events from firewalls, endpoints, and directory servers to identify multi-stage attacks. Which capability is most important for this task?

  1. Separate log stores for each device to preserve local control
  2. Full packet capture retained indefinitely on every endpoint
  3. Centralized log collection with normalized time synchronization Correct answer.
  4. Weekly manual review of each device console by administrators

Explanation

Correlation requires that logs from many sources be collected centrally and share consistent timestamps so events can be sequenced. Without synchronized time, analysts cannot reliably reconstruct attack timelines.

Question 33Cybersecurity

Which activity is performed during the containment phase of an incident response process?

  1. Conducting a lessons-learned review with stakeholders
  2. Determining the root cause and full scope of the intrusion
  3. Restoring systems from known-good backups
  4. Isolating affected hosts from the network to limit spread Correct answer.

Explanation

Containment focuses on limiting the damage and preventing further spread, for example by isolating hosts or blocking malicious traffic. Eradication, recovery, and post-incident review follow later in the process.

Question 34Cybersecurity

An organization must prove to auditors that only authorized personnel can modify financial records in a database. Which control combination best provides this assurance?

  1. Network segmentation between the database and web tier
  2. Full database backups taken every hour
  3. Encryption of the database at rest using a shared key
  4. Role-based access control with logging of all modification attempts Correct answer.

Explanation

Role-based access control restricts modification rights to defined roles, and audit logging records every attempt for later verification. Together they demonstrate both prevention and evidence of authorization.

Question 35Cybersecurity

A developer needs to store a small piece of sensitive configuration data in a way that prevents tampering, and the value must remain readable by the application. Which cryptographic approach is appropriate?

  1. Compress the value with a general-purpose algorithm
  2. Encrypt the value and add a message authentication code Correct answer.
  3. Encode the value using Base64
  4. Hash the value with SHA-256 and store the digest

Explanation

Encryption keeps the value readable by the application, while a message authentication code detects any unauthorized modification. Hashing alone would make the value unreadable, and encoding is not a security control.

Question 36Cybersecurity

A company wants to reduce the risk that a departed employee's credentials remain valid after termination. Which process control is most effective?

  1. Requiring the employee to sign an acceptable use policy at onboarding
  2. Reviewing privileged accounts every twelve months
  3. Enforcing a minimum password length of twelve characters
  4. Automated account deprovisioning triggered by the HR termination record Correct answer.

Explanation

Linking deprovisioning to the HR termination record ensures accounts are disabled promptly and consistently. Manual or periodic processes leave a window in which stale credentials remain usable.

Question 37Cybersecurity

A web application accepts a parameter that is used directly in a database query, allowing an attacker to submit input that returns all user records. Which remediation addresses the root cause?

  1. Use parameterized queries with bound parameters Correct answer.
  2. Add a web application firewall rule blocking the attack string
  3. Restrict the application account to read-only database access
  4. Filter out the single quote character from input

Explanation

Parameterized queries separate code from data so user input cannot alter query structure, eliminating the root cause of SQL injection. Input filtering and firewalls may reduce some attempts but do not fix the flawed query construction.

Question 38Cybersecurity

An analyst observes that an internal host is sending fixed-size DNS queries to a single external domain at regular sixty-second intervals, and the responses are unusually large. Which conclusion is most strongly supported?

  1. The host has a misconfigured DNS resolver causing retransmissions
  2. The host is experiencing a denial-of-service attack from the external domain
  3. The host is performing normal software update checks
  4. The host may be using DNS tunneling for command and control or exfiltration Correct answer.

Explanation

Regular beaconing to one domain with oversized responses is consistent with DNS tunneling, where data is encoded in queries and answers. Normal update traffic typically contacts multiple hosts and does not exhibit such rigid periodic patterns.

Question 39Cybersecurity

A security team is designing controls for a cloud environment where infrastructure is deployed from templates. Which control best prevents unapproved configuration changes from reaching production?

  1. Enable verbose logging on all production virtual machines
  2. Require administrators to document changes in a spreadsheet
  3. Enforce infrastructure-as-code scanning and policy checks in the deployment pipeline Correct answer.
  4. Take daily snapshots of production virtual machines

Explanation

Scanning templates and enforcing policy in the pipeline blocks noncompliant configurations before deployment, shifting control to the earliest point. Snapshots and logging detect or recover from problems but do not prevent changes.

Question 40Cybersecurity

A risk assessment finds a vulnerability with high likelihood and severe impact, but the mitigating control is too costly relative to the organization's budget. Which risk response is being applied when leadership accepts the exposure and monitors it?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk transference
  4. Risk acceptance Correct answer.

Explanation

Risk acceptance means leadership acknowledges the exposure and chooses to retain it, often with monitoring and periodic review. It is a deliberate decision recorded in the risk register rather than an oversight.

Question 41Internet of Things

A hospital wants to attach temperature sensors to vaccine coolers and have each sensor report every five minutes over a low-power wireless link to a gateway. Which IoT architectural layer is primarily responsible for transmitting the readings from the sensors to the gateway?

  1. Perception layer
  2. Connectivity layer Correct answer.
  3. Business layer
  4. Application layer

Explanation

The connectivity (network) layer handles transport of data from devices to gateways and onward networks. The perception layer is where the sensors physically capture the temperature. The application layer delivers the processed data to the monitoring software.

Question 42Internet of Things

Which wireless technology is specifically designed for low-power, low-data-rate IoT devices and operates in sub-GHz ISM bands with long-range capability?

  1. Bluetooth Classic
  2. Zigbee
  3. LoRaWAN Correct answer.
  4. Wi-Fi 6

Explanation

LoRaWAN uses chirp spread spectrum in sub-GHz ISM bands to achieve long range with very low power and small payloads. Bluetooth Classic is comparatively power-hungry and short range. Zigbee and Wi-Fi 6 operate at 2.4 GHz or 5 GHz with different range and power profiles.

Question 43Internet of Things

A building operator wants each floor's lighting sensors to send data through a mesh of intermediate nodes to a single coordinator. Which protocol is purpose-built for low-power mesh networking in this scenario?

  1. MQTT
  2. CoAP
  3. Zigbee Correct answer.
  4. HTTPS

Explanation

Zigbee defines a low-power mesh network with routers forwarding traffic to a coordinator. MQTT and CoAP are application-layer messaging protocols that run over an underlying network. HTTPS is a transport security protocol, not a mesh networking standard.

Question 44Internet of Things

Which protocol is a lightweight publish-subscribe messaging protocol commonly used for IoT telemetry because it uses a broker to decouple publishers and subscribers?

  1. FTP
  2. SNMP
  3. SMTP
  4. MQTT Correct answer.

Explanation

MQTT uses a broker-based publish-subscribe model that decouples data producers from consumers and works well over constrained links. SNMP is for device management, FTP for file transfer, and SMTP for mail delivery. None of those provide the same decoupled telemetry pattern.

Question 45Internet of Things

An IoT security architect wants each device to present a unique cryptographic identity that can be verified by the cloud platform without sharing a common secret. Which mechanism best meets this requirement?

  1. A shared static API key embedded in firmware
  2. A single platform-wide username and password
  3. MAC address filtering at the gateway
  4. A per-device X.509 client certificate Correct answer.

Explanation

Per-device X.509 certificates provide unique cryptographic identities that the platform can verify during mutual TLS. Shared keys and shared credentials mean one compromise exposes every device. MAC filtering is easily spoofed and is not a cryptographic identity.

Question 46Internet of Things

A facilities team deploys battery-powered soil moisture sensors in a remote field where cellular coverage is unavailable and devices must last several years. Which design choice best fits these constraints?

  1. Run each sensor as a full Linux server with an always-on cellular modem
  2. Use a low-power wide-area network with periodic small payloads Correct answer.
  3. Use Bluetooth Classic to stream readings continuously to a distant cloud
  4. Stream continuous video from each sensor over Wi-Fi

Explanation

LPWAN technologies such as LoRaWAN or NB-IoT suit remote, battery-powered devices sending small periodic payloads. Continuous video, always-on modems, and continuous Bluetooth streaming all drain batteries and require infrastructure that is unavailable or unsuitable.

Question 47Internet of Things

Which statement accurately distinguishes the perception layer from the application layer in a typical IoT reference model?

  1. The perception layer hosts dashboards, while the application layer captures sensor data
  2. The perception layer captures physical data via sensors, while the application layer delivers processed services to users Correct answer.
  3. The perception layer routes packets between gateways, while the application layer encrypts radio traffic
  4. The perception layer stores historical records, while the application layer performs analog-to-digital conversion

Explanation

In layered IoT models, the perception layer is the sensing tier that collects physical measurements. The application layer provides the services and interfaces that consume processed data. Routing belongs to the network layer, and storage spans multiple tiers.

Question 48Internet of Things

An engineer must choose between CoAP and HTTP for constrained devices on a lossy network. Which characteristic most justifies selecting CoAP?

  1. CoAP runs over UDP with a compact binary header, reducing overhead on constrained links Correct answer.
  2. CoAP mandates TLS 1.3 for every message, simplifying security
  3. CoAP supports only XML payloads, improving interoperability
  4. CoAP requires a full TCP handshake before each request, improving reliability

Explanation

CoAP is designed for constrained environments and runs over UDP with a compact binary format, lowering overhead. HTTP typically relies on TCP and text-based headers, which are heavier. CoAP does not mandate TLS 1.3 and does not restrict payloads to XML.

Question 49Internet of Things

A fleet of sensors publishes to an MQTT broker, and a subscriber must receive only messages about door-open events while ignoring temperature readings. Which MQTT feature enables this filtering?

  1. Retained message flag
  2. Last Will and Testament
  3. Quality of Service level 2
  4. Topic-based subscriptions with wildcards Correct answer.

Explanation

MQTT subscriptions use topic filters, including wildcards, so a client can subscribe only to door-event topics. QoS levels govern delivery guarantees, retained messages persist the last value, and the Last Will handles unexpected disconnects. None of those filter by topic semantics.

Question 50Internet of Things

A security team discovers that an attacker replayed captured sensor commands to a gateway. Which control most directly prevents replay attacks on IoT command traffic?

  1. Including a nonce and timestamp validated by the receiver Correct answer.
  2. Compressing command payloads before transmission
  3. Rotating the gateway's SSID periodically
  4. Increasing the transmit power of the gateway radio

Explanation

Replay protection relies on freshness checks such as nonces and timestamps that the receiver validates. Compression, transmit power, and SSID rotation do not affect whether an old message is accepted as new. A valid message replayed later would still be rejected with nonce and timestamp checks.