I85PREP
⌘ K
CWIIP study materials
CWIIP study resources

CWIIP practice questions

One question at a time. Build your CWIIP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In MQTT version 3.1.1, which packet type is sent by a client to establish a session and must be the first packet exchanged on a new network connection?

  1. CONNECT Correct answer.
  2. PINGREQ
  3. PUBLISH
  4. SUBSCRIBE

Explanation

The MQTT specification requires that the first packet a client sends on a newly established network connection be a CONNECT packet carrying client identifier, keep-alive, clean-session flag, and optional will and credentials. Only after the server returns CONNACK may the client publish or subscribe. Any other packet arriving first is a protocol violation and the server must close the connection.

Question 2Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A CoAP client sends a confirmable GET request but receives no response within its retransmission window and exhausts all retransmissions. What has the client observed according to RFC 7252?

  1. A request timeout, after which the client may treat the outcome as unknown and decide whether to retry Correct answer.
  2. A reset message indicating the server rejected the request
  3. A successful but empty acknowledgment confirming delivery
  4. A piggybacked response that was lost in transit

Explanation

RFC 7252 defines a request/response timeout that occurs when a confirmable message has been retransmitted the maximum number of times without an ACK or response. At that point the client cannot know whether the server processed the request, so the outcome is indeterminate and retry is an application decision. This differs from receiving an explicit RST or a piggybacked response.

Question 3Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In DDS, which entity is responsible for matching a DataWriter with compatible DataReaders based on topic, type, and QoS?

  1. The Subscriber
  2. The DomainParticipant Correct answer.
  3. The Topic
  4. The Publisher

Explanation

The DomainParticipant acts as the container and discovery anchor within a domain: it performs discovery and matches writers to readers whose topic, type, and QoS are compatible. Publishers and Subscribers are grouping entities that own writers and readers, and the Topic is a description of data, not a matching agent.

Question 4Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

An AMQP 1.0 sender needs an outcome in which the receiver has taken responsibility for the message and will not ask for it again. Which terminus outcome should the receiver send?

  1. rejected
  2. modified
  3. accepted Correct answer.
  4. released

Explanation

In AMQP 1.0 the accepted outcome means the receiver has processed the message and taken ownership, so the sender may consider delivery complete and discard its copy. Released means the message was not processed and may be redelivered, while rejected and modified signal failure or altered state requiring further sender action.

Question 5Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Which MQTT feature lets a broker store a message published to a topic so that a later-connecting subscriber still receives it?

  1. A clean session
  2. Quality of Service 2
  3. A retained message Correct answer.
  4. A will message

Explanation

A retained message is stored by the broker on the topic and delivered to any future subscriber that matches the topic, which is how MQTT supports last-known-state distribution. QoS 2 governs delivery guarantees, a will is published on abnormal disconnect, and clean session controls session persistence rather than stored payloads.

Question 6Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A CoAP server returns a response with code 2.05 Content. How should a client interpret this code?

  1. The resource was created as a result of the request
  2. The request lacked proper authorization
  3. The request succeeded and the payload contains the representation Correct answer.
  4. The request was valid but the server has no representation to return

Explanation

CoAP response codes follow the class.detail convention, and class 2 indicates success. The 2.05 code specifically means the request succeeded and the response carries the current representation of the target resource. Creation is 2.01, an empty success is 2.04, and authorization failures fall in class 4.

Question 7Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In DDS, a DataWriter is configured with a History QoS of KEEP_LAST with depth 1 and RELIABLE reliability. A slow DataReader falls behind while the writer publishes rapidly. What is the most likely result?

  1. The writer blocks or reports a slow-reader condition because it must retain unacknowledged samples Correct answer.
  2. The writer automatically downgrades reliability to BEST_EFFORT for that reader
  3. The reader receives only the newest sample and older ones are dropped without notice
  4. The writer silently overwrites older samples and the reader receives every sample anyway

Explanation

With RELIABLE reliability the writer must retain samples until they are acknowledged, and KEEP_LAST depth 1 bounds that history. If the reader lags, the writer cannot discard unacknowledged data without violating reliability, so it hits its resource or history limits and reports a slow-reader situation. Overwriting unacknowledged samples would break the reliability contract.

Question 8Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Which statement describes how AMQP 1.0 links relate to sessions?

  1. A session may contain only one link in each direction at a time
  2. A link is bidirectional and can span multiple independent connections
  3. A link is unidirectional and exists within a session, which in turn runs over a connection Correct answer.
  4. Links are established before the connection handshake completes

Explanation

AMQP 1.0 layers its model as connection, then session, then link. Each link carries messages in one direction only, so a sender link and a receiver link are separate, and many links may share one session multiplexed over a single connection.

Question 9Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A CoAP client wants to learn about changes to a sensor resource over time without polling. Which mechanism should it use?

  1. Use a POST with a block-wise transfer to the resource
  2. Include the Observe option with value 0 in the GET request Correct answer.
  3. Send repeated confirmable GET requests with a short timeout
  4. Set the No-Response option to suppress acknowledgments

Explanation

RFC 7641 extends CoAP with the Observe option: a GET carrying Observe set to 0 registers the client as an observer, and the server then sends notifications as the representation changes. Polling achieves a similar effect but wastes energy and bandwidth, which is why Observe exists for constrained nodes.

Question 10Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

An MQTT client subscribes to 'sensors/+/temp' and a publisher sends to 'sensors/room1/temp'. Which statement about the match is correct?

  1. The single-level wildcard '+' matches exactly one topic level, so the message is delivered Correct answer.
  2. The message is delivered only if the publisher also uses a wildcard
  3. The '+' wildcard matches any number of levels, so only multi-level topics match
  4. The subscription fails because '+' must appear only at the end of a filter

Explanation

In MQTT topic filters, '+' substitutes for exactly one topic level and may appear at any level of the filter, including the middle. Therefore 'sensors/+/temp' matches 'sensors/room1/temp' but would not match 'sensors/room1/sub/temp'. The multi-level wildcard '#' is the one that spans arbitrary levels.

Question 11Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Which DDS QoS policy determines whether a DataWriter waits for a minimum number of matching DataReaders before it begins publishing?

  1. LIVELINESS
  2. PARTITION
  3. DURABILITY
  4. RELIABILITY Correct answer.

Explanation

This is controlled by the RELIABILITY QoS combined with the writer's offered reliability and the reader's requested reliability; when a reader requests RELIABLE, the writer must ensure delivery to matched readers. DURABILITY concerns persistence for late joiners, LIVELINESS detects silent failures, and PARTITION groups endpoints by name.

Question 12Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

What does the MQTT CONNACK return code 0x05 signify to a connecting client?

  1. The connection was refused because the protocol version is unsupported
  2. The connection was accepted and the session is present
  3. The connection was accepted but the session state was cleared
  4. The connection was refused because the client is not authorized Correct answer.

Explanation

In MQTT 3.1.1 the CONNACK return codes are defined values: 0x00 accepted, 0x01 unacceptable protocol version, 0x02 identifier rejected, 0x03 server unavailable, 0x04 bad credentials, and 0x05 not authorized. Code 0x05 therefore tells the client that authentication succeeded but the server refuses to grant access.

Question 13Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In AMQP 1.0, what is the purpose of the transfer frame's more flag and the associated flow control?

  1. It requests that the receiver immediately settle the delivery
  2. It indicates that more transfer frames for the same delivery follow, allowing a large message to be split Correct answer.
  3. It signals that the link should be detached after the transfer
  4. It marks the message as rejected by the sender

Explanation

AMQP 1.0 can fragment a single message across multiple transfer frames, and the more flag tells the receiver that additional frames belonging to the same delivery are coming. Link credit granted through flow frames bounds how many deliveries may be in flight, which is the mechanism that prevents a fast sender from overrunning a slow receiver.

Question 14Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A CoAP message is sent over UDP and the client needs the server to acknowledge receipt at the message layer without yet producing the final response. Which message should the server send?

  1. A separate CON response with a new message ID
  2. An empty ACK carrying the same message ID Correct answer.
  3. A RST with the same message ID
  4. A NON response with the same token

Explanation

RFC 7252 allows a server to send an empty ACK to stop retransmission when it cannot answer immediately, and later deliver the actual response in a separate confirmable message. This separates message-layer acknowledgment from the request/response exchange and keeps the client from retransmitting.

Question 15Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Which MQTT packet does a subscriber send to end a subscription so that the broker stops delivering matching messages?

  1. UNSUBSCRIBE Correct answer.
  2. DISCONNECT
  3. SUBACK
  4. PUBACK

Explanation

UNSUBSCRIBE carries one or more topic filters that the client wants removed, and the broker replies with UNSUBACK. DISCONNECT ends the network connection but does not selectively remove filters, and SUBACK and PUBACK are acknowledgments for other flows.

Question 16Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A DDS application needs a DataReader to receive samples published before it joined, as long as the writer still holds them. Which DURABILITY setting on both endpoints enables this?

  1. TRANSIENT
  2. PERSISTENT
  3. TRANSIENT_LOCAL Correct answer.
  4. VOLATILE

Explanation

TRANSIENT_LOCAL durability lets a late-joining reader receive samples that the DataWriter still holds in its history cache, which is the common choice for state replication among live participants. VOLATILE provides no historical delivery, while TRANSIENT and PERSISTENT extend retention beyond the writer's lifetime and usually require a durability service.

Question 17Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In AMQP 1.0, which frame type is used by a receiver to grant link credit to a sender?

  1. attach
  2. disposition
  3. flow Correct answer.
  4. begin

Explanation

The flow frame carries the link-credit field, which tells the sender how many more deliveries the receiver is willing to accept. Attach establishes a link, disposition reports outcomes for deliveries, and begin opens a session, so none of those carries credit.

Question 18Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Why does CoAP typically run over UDP rather than TCP in constrained IoT networks?

  1. CoAP requires broadcast delivery that TCP cannot provide
  2. UDP guarantees ordered delivery, which simplifies the CoAP message layer
  3. UDP encrypts payloads by default, removing the need for DTLS
  4. UDP avoids the connection setup and header overhead of TCP, and CoAP supplies its own lightweight reliability Correct answer.

Explanation

CoAP was designed for constrained nodes and networks, so it uses UDP to avoid TCP handshake latency and per-connection state, and it adds its own confirmable message and retransmission scheme for reliability. Ordering and congestion behavior are handled at the application layer rather than inherited from TCP.

Question 19Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

An MQTT publisher sends a QoS 1 message and the broker replies with PUBACK. What guarantee does QoS 1 provide?

  1. Exactly once delivery using a four-way handshake
  2. At most once delivery, so messages may be lost but never duplicated
  3. Delivery only to subscribers that are online at publish time
  4. At least once delivery, so duplicates are possible if the acknowledgment is lost Correct answer.

Explanation

QoS 1 requires the receiver to acknowledge with PUBACK, and the sender retransmits if no acknowledgment arrives, which yields at-least-once delivery and permits duplicates. Exactly-once is the QoS 2 flow, and at-most-once is QoS 0, which has no acknowledgment at all.

Question 20Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A CoAP client sends a request to a resource that does not exist on the server. Which response code should it expect?

  1. 2.05 Content
  2. 5.03 Service Unavailable
  3. 4.13 Request Entity Too Large
  4. 4.04 Not Found Correct answer.

Explanation

CoAP uses 4.04 Not Found to indicate that the server has no resource matching the request URI, which mirrors HTTP 404 semantics within the client-error class. Server-side overload is reported with 5.03, and an oversized request body triggers 4.13.

Question 21Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In DDS, what role does the Topic entity play in the publish-subscribe model?

  1. It assigns network addresses to participants in a domain
  2. It enforces security policies on all endpoints in the domain
  3. It defines the name and data type that writers and readers must share to match Correct answer.
  4. It stores the history of all samples for late-joining readers

Explanation

A Topic binds a name to a data type, and DDS only matches a DataWriter with a DataReader when both refer to the same topic and compatible type and QoS. Storage of historical samples is handled by the writer's history and durability QoS, not by the Topic itself.

Question 22Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

An AMQP 1.0 receiver sends a disposition with outcome 'released' for a delivery. What should the sender conclude?

  1. The message was not processed and may be resent, possibly to another receiver Correct answer.
  2. The message was modified and must be delivered to the same node again
  3. The message was permanently rejected and must be discarded
  4. The message was accepted and the sender may discard it

Explanation

Released means the receiver did not take responsibility for the message, so the sender is free to retransmit it, including on a different link or to a different node. This contrasts with accepted, which is final, and with rejected, which carries an error and typically goes to a dead-letter path.

Question 23Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

A device publishes an MQTT will message. Under which circumstance does the broker publish it?

  1. When a subscriber uses a wildcard topic filter
  2. When the client disconnects abnormally without sending DISCONNECT Correct answer.
  3. Every time the client publishes any regular message
  4. When the client sends a PINGREQ after an idle period

Explanation

The will is registered at CONNECT and is published by the broker only when the connection ends abnormally, such as a network failure, keep-alive timeout, or protocol violation. A graceful DISCONNECT normally suppresses the will, which is how peers distinguish a clean shutdown from a failure.

Question 24Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

Which CoAP option is used to carry a block of a large request or response body during block-wise transfer?

  1. Location-Path
  2. Block1 Correct answer.
  3. Max-Age
  4. Observe

Explanation

RFC 7959 defines Block1 for transferring a large request body in numbered blocks and Block2 for a large response body. The Observe option registers for notifications, Location-Path conveys a created resource URI, and Max-Age bounds response freshness.

Question 25Wireless IoT higher layer protocols (MQTT, CoAP, DDS, AMQP)

In AMQP 1.0, what does the session-level window used in flow control limit?

  1. The number of connections a container may open
  2. The number of bytes of transfer payload the receiver is willing to buffer across the session Correct answer.
  3. The number of links that may exist on the connection
  4. The maximum size of a single frame on the connection

Explanation

AMQP 1.0 has two flow-control layers: link credit limits how many deliveries may be in flight, and the session incoming-window and outgoing-window limit the bytes a peer may send before it must wait. The frame size limit is negotiated separately in the open frame's max-frame-size field.

Question 26Security solutions used within IoT integration projects

An IoT integration team is choosing a lightweight security protocol for constrained devices that use UDP and require DTLS-based protection. Which standardized approach should they select for securing CoAP traffic?

  1. IPsec ESP in tunnel mode
  2. HTTPS with mutual certificate authentication
  3. TLS 1.3 directly over UDP transport
  4. OSCORE at the application layer over CoAP Correct answer.

Explanation

OSCORE (RFC 8613) protects CoAP message payloads at the application layer and is designed for constrained nodes, providing end-to-end security even through proxies. It complements DTLS rather than replacing transport security.

Question 27Security solutions used within IoT integration projects

In an IoT deployment, a device authenticates to an MQTT broker using a client certificate over TLS. Which security property does this configuration primarily provide?

  1. Message payload compression for bandwidth savings
  2. Quality-of-service guarantee for delivered messages
  3. Automatic firmware version enforcement
  4. Mutual authentication between client and broker Correct answer.

Explanation

When both the broker presents a certificate and the client presents one, TLS performs mutual authentication, verifying identities on both sides. Payload compression, firmware enforcement, and QoS are separate concerns not provided by certificate authentication.

Question 28Security solutions used within IoT integration projects

A security architect wants to prevent a compromised IoT gateway from reading sensor plaintext while still allowing the gateway to route messages. Which design principle best achieves this?

  1. Terminate TLS at the gateway and forward plaintext upstream
  2. Rely on VLAN segmentation between sensors and gateway
  3. Use end-to-end encryption between sensor and cloud backend Correct answer.
  4. Enable MQTT QoS 2 for all sensor publications

Explanation

End-to-end encryption keeps plaintext inaccessible to intermediaries like gateways, so a compromised gateway can route ciphertext without reading it. TLS termination at the gateway or segmentation alone leaves data readable at the gateway.

Question 29Security solutions used within IoT integration projects

Which OWASP IoT Top 10 risk category directly describes devices shipped with default or hard-coded credentials that attackers can exploit?

  1. Use of insecure or outdated components
  2. Insufficient privacy protection
  3. Weak, guessable, or hard-coded passwords Correct answer.
  4. Insecure ecosystem interfaces

Explanation

The OWASP IoT Top 10 explicitly lists weak, guessable, or hard-coded passwords as a distinct risk category. This covers default credentials and embedded secrets that enable unauthorized access.

Question 30Security solutions used within IoT integration projects

A company deploys thousands of IoT sensors that must rotate cryptographic keys without manual intervention. Which mechanism is most appropriate?

  1. A spreadsheet-based key inventory reviewed quarterly
  2. Static keys embedded at manufacturing time
  3. An automated key management service integrated with device identity Correct answer.
  4. A hardware security module shared by all sensors

Explanation

Automated key management tied to device identity enables scalable rotation and revocation across large fleets. Static embedded keys and manual inventories cannot support timely rotation.

Question 31Security solutions used within IoT integration projects

An IoT platform uses a public key infrastructure where each device holds a private key in a secure element. What is the primary benefit of storing the key in a secure element rather than general flash memory?

  1. It protects the key from extraction even if the main firmware is compromised Correct answer.
  2. It removes the need for certificate validation
  3. It increases the device's radio range
  4. It guarantees firmware updates are authenticated

Explanation

A secure element isolates key material from the main processor and memory, making extraction significantly harder even when firmware is compromised. It does not affect radio range or eliminate certificate validation.

Question 32Security solutions used within IoT integration projects

A team wants to detect anomalous behavior from an IoT device that has been compromised and is communicating with a command-and-control server. Which control is most directly suited to this goal?

  1. Full-disk encryption on the device
  2. Physical tamper-evident seals on device enclosures
  3. Network traffic monitoring with behavioral baselining Correct answer.
  4. Password complexity policies for user accounts

Explanation

Behavioral baselining of network traffic can flag deviations such as unexpected outbound connections to unknown hosts. Disk encryption, password policy, and physical seals do not detect command-and-control communication.

Question 33Security solutions used within IoT integration projects

Which security control best mitigates the risk of an attacker physically accessing a deployed IoT device's debug port to extract firmware?

  1. Increasing the Wi-Fi transmit power
  2. Using a shorter MQTT keepalive interval
  3. Disabling or locking the debug interface in production Correct answer.
  4. Rotating the device's network password monthly

Explanation

Locking or disabling debug interfaces such as JTAG or UART in production prevents attackers from using them to read firmware or memory. Network-side controls like keepalives or password rotation do not address physical debug access.

Question 34Security solutions used within IoT integration projects

An integration project must ensure that firmware updates are only accepted if they originate from the vendor and have not been tampered with. Which mechanism should be implemented?

  1. Digitally signing update packages and verifying signatures on the device Correct answer.
  2. Compressing update packages to reduce size
  3. Requiring a device reboot before applying updates
  4. Serving updates over HTTP to simplify delivery

Explanation

Digital signatures allow the device to verify both the origin and integrity of firmware updates before installation. Compression, transport choice, and reboot sequencing do not provide authenticity guarantees.

Question 35Security solutions used within IoT integration projects

A security engineer is designing segmentation for an IoT network where sensors must reach only a local broker. Which approach best enforces least-privilege network access?

  1. Relying on WPA2-PSK shared across the site
  2. Enabling broadcast forwarding between all VLANs
  3. Placing all devices on a flat corporate VLAN
  4. Using microsegmentation with allowlists for sensor-to-broker flows Correct answer.

Explanation

Microsegmentation with explicit allowlists restricts traffic to only the required sensor-to-broker flows, enforcing least privilege. Flat networks, shared pre-shared keys, and broad broadcast forwarding expand reachability.

Question 36Security solutions used within IoT integration projects

Which protocol is specifically designed to provide authentication and authorization for constrained IoT devices using a lightweight framework over CoAP?

  1. OAuth 2.0 with bearer tokens over HTTPS
  2. SAML 2.0 assertions
  3. Kerberos with ticket-granting services
  4. ACE framework with OSCORE profiles Correct answer.

Explanation

The ACE (Authentication and Authorization for Constrained Environments) framework, standardized in RFC 9200, defines authorization for constrained devices and can leverage OSCORE for protection. OAuth, Kerberos, and SAML are not tailored to constrained CoAP environments.

Question 37Security solutions used within IoT integration projects

A product team wants to reduce the attack surface of an IoT camera before release. Which action most directly reduces exposed services?

  1. Extending the default admin session timeout
  2. Increasing the video resolution
  3. Disabling unused network services and closing unused ports Correct answer.
  4. Adding a second wireless radio

Explanation

Disabling unused services and closing unused ports removes entry points attackers could exploit, directly shrinking attack surface. Adding radios or increasing resolution adds functionality without reducing exposure.

Question 38Security solutions used within IoT integration projects

An IoT integrator must protect data at rest on a gateway that stores sensor logs. Which control is most appropriate?

  1. Applying QoS 1 to log publications
  2. Encrypting the storage volume with managed keys Correct answer.
  3. Enabling SNMPv3 on the gateway
  4. Using MQTT retained messages

Explanation

Encrypting stored data with managed keys protects logs at rest if the storage medium is lost or stolen. SNMPv3 and MQTT features govern monitoring and messaging, not data-at-rest confidentiality.

Question 39Security solutions used within IoT integration projects

During an IoT integration project, a team must verify that third-party device firmware components do not contain known vulnerabilities. Which practice best supports this?

  1. Disabling logging to reduce storage use
  2. Relying on the vendor's marketing claims
  3. Testing only the device's web interface
  4. Software bill of materials combined with vulnerability scanning Correct answer.

Explanation

A software bill of materials enumerates components so they can be checked against vulnerability databases, supporting timely remediation. Vendor claims and limited interface testing do not provide systematic component visibility.

Question 40Security solutions used within IoT integration projects

Which attack specifically targets IoT devices by exploiting weak or default telnet credentials to recruit them into a botnet?

  1. Cross-site scripting in a dashboard
  2. Mirai-style credential brute forcing Correct answer.
  3. DNS cache poisoning
  4. SQL injection against a web form

Explanation

Mirai and similar malware scan for IoT devices with default or weak telnet credentials and enlist them into botnets for DDoS attacks. SQL injection, XSS, and DNS poisoning target different layers and mechanisms.

Question 41Security solutions used within IoT integration projects

A security team wants to ensure that only authorized devices can publish to a specific MQTT topic. Which broker-side mechanism should be configured?

  1. Topic access control lists tied to client identities Correct answer.
  2. TLS session resumption
  3. A longer keepalive timeout
  4. A larger maximum message size

Explanation

Broker-side topic ACLs restrict publish and subscribe permissions per authenticated client identity. Keepalive, message size, and session resumption settings affect performance, not authorization.

Question 42Security solutions used within IoT integration projects

Which property of a hardware root of trust makes it valuable for secure boot in IoT devices?

  1. It stores the first verification key in immutable hardware Correct answer.
  2. It automatically patches application software
  3. It provides high-bandwidth network connectivity
  4. It increases the device's battery capacity

Explanation

A hardware root of trust anchors verification in immutable hardware so the boot chain can be validated from a trusted starting point. It does not provide networking, patching, or power benefits.

Question 43Security solutions used within IoT integration projects

An integrator is comparing TLS and DTLS for securing IoT communications. Which statement correctly distinguishes them?

  1. DTLS provides encryption while TLS provides only integrity
  2. TLS cannot use certificates while DTLS can
  3. TLS operates over reliable streams while DTLS operates over datagrams Correct answer.
  4. DTLS requires TCP while TLS requires UDP

Explanation

TLS is designed for reliable, ordered transports such as TCP, while DTLS adapts TLS for unreliable datagram transports such as UDP. Both support certificates and provide confidentiality and integrity.

Question 44Security solutions used within IoT integration projects

A medical IoT device transmits patient vitals. Which control most directly addresses privacy requirements for data in transit and at rest?

  1. Storing vitals in plaintext for easier debugging
  2. Publishing vitals to a public MQTT topic
  3. Encrypting data in transit with TLS and at rest with managed keys Correct answer.
  4. Using a shared password across all devices

Explanation

Encrypting data both in transit and at rest protects patient information from interception and unauthorized storage access. Public topics, plaintext storage, and shared passwords all increase privacy risk.

Question 45Security solutions used within IoT integration projects

Which approach best protects an IoT device's unique identity from being cloned onto counterfeit hardware?

  1. Broadcasting the identity in periodic beacon frames
  2. Storing the identity in a per-device secure element with attestation Correct answer.
  3. Embedding the same identity in all devices of a model
  4. Writing the identity to a plaintext configuration file

Explanation

A per-device secure element with attestation binds identity to hardware that is difficult to clone, and attestation lets the backend verify genuine devices. Plaintext files, broadcasts, or shared identities are easily copied.

Question 46Security solutions used within IoT integration projects

A team deploying LoRaWAN sensors asks which security layer encrypts application payloads end to end. Which key is used?

  1. The network session key
  2. The device's Wi-Fi pre-shared key
  3. The join server's root key
  4. The application session key Correct answer.

Explanation

In LoRaWAN, the application session key encrypts application payloads end to end between the device and the application server. The network session key protects signaling between device and network server.

Question 47Security solutions used within IoT integration projects

A security operations team needs to detect when an IoT device's firmware has been modified outside the approved update process. Which control is most effective?

  1. Increasing the device's logging verbosity
  2. Enabling DHCP on the device
  3. Periodic integrity measurement compared against known-good baselines Correct answer.
  4. Adding a second network interface

Explanation

Measuring firmware integrity and comparing it to a known-good baseline reveals unauthorized modifications. Verbose logging, DHCP, and extra interfaces do not establish whether firmware is unmodified.

Question 48Security solutions used within IoT integration projects

Which risk is most specific to integrating legacy industrial IoT devices that cannot support modern encryption into a cloud-connected environment?

  1. They always support the latest TLS versions
  2. Protecting their traffic requires compensating controls such as gateways that add security Correct answer.
  3. They cannot connect to any network
  4. Their CPUs are too fast for cloud protocols

Explanation

Legacy devices often lack modern crypto, so integrators deploy compensating controls like security gateways that terminate and re-establish protected sessions. The other statements misstate legacy device capabilities.

Question 49Security solutions used within IoT integration projects

A cloud IoT platform must ensure that a device's access token has the minimum privileges needed. Which authorization model best supports fine-grained, scoped permissions?

  1. A single administrator account shared by all devices
  2. Anonymous access with rate limiting
  3. Network address allowlisting alone
  4. Role-based or attribute-based access control with scoped policies Correct answer.

Explanation

Role-based or attribute-based access control with scoped policies grants only the permissions each device needs. Shared accounts, address allowlists alone, or anonymous access cannot enforce least privilege per device.

Question 50Security solutions used within IoT integration projects

Which measure best reduces the risk of an over-the-air update being delivered to the wrong device model and causing a bricked deployment?

  1. Binding updates to device model and version with server-side targeting checks Correct answer.
  2. Sending updates to every device simultaneously without checks
  3. Using unencrypted broadcast channels for updates
  4. Relying on device users to confirm each update manually

Explanation

Binding updates to specific model and version identifiers, with server-side targeting, prevents incompatible firmware from reaching devices. Broadcasts and user-dependent confirmation increase the risk of misdelivery.