CIoTSP study materials
CIoTSP study resources

CIoTSP case studies

CIoTSP · Put your knowledge to work in context.

The Certified Internet of Things Security Practitioner (CIoTSP) is an independent, vendor-neutral credential for professionals who secure connected devices and the systems around them. It suits security analysts, network and cloud engineers, embedded developers, and OT/IT staff moving into IoT security. The exam spans eight domains: IoT architecture and security fundamentals; device security and hardening; network and communication security; identity, access, and key management; data security and privacy; cloud and edge security; threat modeling, risk, and vulnerability management; and incident response, monitoring, and governance. Questions are multiple choice and scenario-based, testing judgment about constrained devices, long device lifecycles, and weak physical security rather than product trivia. The CIoTSP case studies are 5 cases and about 3,030 words.

1

Flat OT Network in a Mixed-Use Tower

Northgate Properties operates a 14-floor mixed-use tower with roughly 1,900 IoT endpoints: BACnet/IP VAV controllers, Modbus RTU energy meters behind serial gateways, and Zigbee luminaires. A cloud BMS vendor reaches the building through one site-to-site VPN terminating at an on-premises gateway.

670 words, about 3 min
2

Cellular Water Meters with Factory Defaults

Calder Water Authority operates 2,500 NB-IoT water meters across a rural service area. Firmware 1.2 sets each meter's admin password to the last six digits of its serial number and leaves secure boot disabled on 700 units installed before 2023.

591 words, about 3 min
3

ABP LoRaWAN Sensors in Remote Irrigation

Riverton Irrigation Cooperative runs 1,200 LoRaWAN soil-moisture sensors and 14 gateways across 60 km of farmland. Three hundred sensors installed in 2021 use ABP with static root and session keys; the rest use OTAA.

588 words, about 3 min
4

Infusion Pump Certificates and a Shared Biomed Account

Mercy Regional Hospital has 900 networked infusion pumps using mutual TLS to a vendor management platform. Device certificates are issued by the vendor's CA, have two-year lifetimes, and 540 expire within nine months.

591 words, about 3 min
5

Nightly Reboots at Traffic Intersection 42

Metro City's traffic management center operates 420 cellular-connected signal controllers. A vendor maintains the central ATMS and holds a persistent VPN into the controller VLAN.

590 words, about 3 min