I85PREP
⌘ K
ISO 27400 Lead Manager study materials
ISO 27400 Lead Manager study resources

ISO 27400 Lead Manager practice questions

One question at a time. Build your ISO 27400 Lead Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of IoT security

In ISO/IEC 27400, which statement best describes the purpose of the IoT security risk assessment before controls are selected?

  1. It certifies that every device in the deployment conforms to an international test standard
  2. It identifies assets, threats, and vulnerabilities so that controls are proportionate to the risk Correct answer.
  3. It replaces the need for an inventory because risk registers already list all devices
  4. It guarantees that residual risk is transferred to the network operator

Explanation

The standard treats risk assessment as the starting point: assets, threats and vulnerabilities are identified so that security controls can be chosen in proportion to the identified risk. It is not a conformity certification and does not remove the need for an asset inventory or for accepting residual risk.

Question 2Fundamental concepts and principles of IoT security

According to ISO/IEC 27400, which characteristic most distinguishes IoT devices from conventional IT endpoints in a security programme?

  1. They are exempt from patch management because firmware is immutable
  2. They typically have constrained resources and long, often unattended, operational lifetimes Correct answer.
  3. They are managed by the same tooling as employee laptops
  4. They are always connected through a public mobile network

Explanation

IoT devices commonly combine limited computing, memory and power with deployment lifetimes measured in years and little physical supervision, which shapes the whole security approach. Connectivity type and management tooling vary widely and cannot be assumed.

Question 3Fundamental concepts and principles of IoT security

A utility deploys smart meters that must remain in service for fifteen years. Which ISO/IEC 27400-aligned consideration should drive the procurement decision most directly?

  1. The physical colour and casing material of the meter enclosure
  2. The ability to receive security updates and support throughout the operational lifetime Correct answer.
  3. The vendor's marketing material describing the meter as secure by design
  4. The number of communication protocols the meter can simultaneously support

Explanation

Long operational lifetimes mean the device must be supportable, patchable and updatable across that horizon. Procurement should therefore assess the supplier's update and support commitments, not marketing claims or irrelevant hardware attributes.

Question 4Fundamental concepts and principles of IoT security

Which pairing of IoT security principle and practice is most consistent with ISO/IEC 27400 guidance on secure configuration?

  1. Secure by default - devices ship with unique credentials and unnecessary services disabled Correct answer.
  2. Deferred by default - security settings are configured only after the first incident
  3. Open by default - devices ship with remote debugging enabled to speed up support
  4. Uniform by default - all devices share one factory password to simplify onboarding

Explanation

Secure-by-default configuration means devices leave the factory with unique credentials and only the services that are needed, so exposure is minimized before any operator action. Shared passwords, open debugging interfaces and reactive configuration all increase risk.

Question 5Fundamental concepts and principles of IoT security

An organization must decide how much logging to enable on a fleet of battery-powered environmental sensors. Which reasoning best reflects the ISO/IEC 27400 principle of balancing security with operational constraints?

  1. Log only successful authentication events and ignore failures
  2. Enable every available log level because storage on the backend is inexpensive
  3. Select event logging that supports detection needs while respecting power and bandwidth limits Correct answer.
  4. Disable logging entirely because constrained devices cannot support it

Explanation

The guidance recognizes that security measures must be feasible for constrained devices, so logging should be scoped to what supports detection and investigation without exhausting power or bandwidth. Neither maximal logging nor no logging reflects that balance.

Question 6Fundamental concepts and principles of IoT security

In ISO/IEC 27400 terms, which activity belongs to the 'operate' phase rather than to initial design?

  1. Defining the security requirements in the device specification
  2. Selecting a cryptographic library for the firmware build
  3. Threat modelling of the device architecture before coding begins
  4. Continuous monitoring of device behaviour and security event handling Correct answer.

Explanation

Monitoring and event handling are operational activities that continue while devices are deployed, whereas threat modelling, library selection and requirement definition are design-time tasks. Separating the phases helps ensure controls are maintained, not just built once.

Question 7Fundamental concepts and principles of IoT security

Which control most directly addresses the ISO/IEC 27400 concern that IoT devices are often physically accessible to attackers?

  1. Requiring complex passwords for the cloud dashboard
  2. Encrypting all traffic between the device and the cloud gateway
  3. Tamper detection and protection of debug and storage interfaces on the device Correct answer.
  4. Segmenting the corporate Wi-Fi network from the guest network

Explanation

Physical accessibility means an attacker may open the enclosure, attach to debug ports or read storage, so tamper resistance and interface protection are the direct mitigations. Network encryption and account policy address different threat paths.

Question 8Fundamental concepts and principles of IoT security

A hospital connects infusion pumps to its clinical network. Applying ISO/IEC 27400 network security guidance, which measure best limits the impact of a compromised pump?

  1. Placing the pumps in a dedicated network segment with restrictive rules to clinical systems Correct answer.
  2. Using a single shared administrator account for all pumps to simplify support
  3. Giving the pumps direct access to the internet for vendor diagnostics
  4. Disabling audit logging on the pump management server to save storage

Explanation

Segmentation with tightly scoped communication rules contains a compromised device and limits lateral movement into clinical systems. Direct internet access, shared accounts and disabled logging all widen exposure or destroy accountability.

Question 9Fundamental concepts and principles of IoT security

Which statement correctly captures the ISO/IEC 27400 position on data protection for IoT devices that collect personal information?

  1. Privacy requirements should be considered together with security throughout the device lifecycle Correct answer.
  2. Encryption is unnecessary if the data is stored only briefly
  3. Data protection obligations end once the data leaves the device
  4. Privacy is a purely legal matter with no security engineering implications

Explanation

The guidance treats privacy and security as linked concerns to be addressed across the lifecycle, from data minimization at design through protection in operation. Security obligations do not stop at the device boundary and short retention is not a substitute for protection.

Question 10Fundamental concepts and principles of IoT security

An engineer proposes storing a single fleet-wide API key in every device's firmware. Which ISO/IEC 27400 principle does this most clearly violate?

  1. Network segmentation of device traffic
  2. Unique identity and credential per device Correct answer.
  3. Time synchronization across the fleet
  4. Least privilege for administrative accounts

Explanation

Each device should hold its own identity so that compromise of one unit does not grant access for the whole fleet. A shared key destroys that separation and cannot be revoked for a single device without disrupting all of them.

Question 11Fundamental concepts and principles of IoT security

Which practice best supports the ISO/IEC 27400 recommendation for maintaining a trustworthy software supply chain for IoT devices?

  1. Allowing any technician to sign firmware images with a shared password
  2. Verifying firmware integrity and provenance before installation on devices Correct answer.
  3. Disabling secure boot to simplify field recovery
  4. Accepting firmware from suppliers without verification to avoid deployment delays

Explanation

Integrity and provenance verification ensures that only authentic, unmodified firmware reaches devices. Unverified images, weak signing practices and disabled secure boot all undermine trust in the supply chain.

Question 12Fundamental concepts and principles of IoT security

What does ISO/IEC 27400 guidance imply about the relationship between security and safety for IoT devices used in industrial control?

  1. Security failures can cause physical harm, so safety and security should be assessed together Correct answer.
  2. Safety is the responsibility of the process engineer and never interacts with security
  3. Safety certification automatically satisfies all IoT security requirements
  4. Security controls may freely interrupt safety functions because availability is secondary

Explanation

Where devices act on the physical world, a security compromise can directly cause injury or environmental damage, so the two disciplines must be assessed jointly. Safety certification addresses hazards, not the adversarial threats that security controls manage.

Question 13Fundamental concepts and principles of IoT security

Which element is most essential to an ISO/IEC 27400-aligned asset inventory for an IoT deployment?

  1. The identity, location, firmware version and owner of each device Correct answer.
  2. The number of employees trained on the device
  3. The marketing name of the device vendor
  4. The purchase price of each device model

Explanation

An effective inventory records enough detail to locate, identify and manage each device, including firmware state and accountability. Commercial or promotional attributes do not support security operations.

Question 14Fundamental concepts and principles of IoT security

A vendor states that its IoT gateway cannot be patched in the field and has no update mechanism. Which ISO/IEC 27400-aligned response is most appropriate?

  1. Assume the device is safe because it is not connected to the internet
  2. Accept the limitation because gateways are inherently unpatched components
  3. Disable all logging on the gateway so the limitation is not visible
  4. Compensate with network controls and plan replacement, while recording the residual risk Correct answer.

Explanation

When a device cannot be updated, the organization should apply compensating controls such as segmentation and monitoring, plan for replacement, and formally record the accepted residual risk. Passive acceptance or concealment leaves the exposure unmanaged.

Question 15Fundamental concepts and principles of IoT security

Which authentication approach best reflects ISO/IEC 27400 guidance for machine-to-machine communication between IoT devices and backend services?

  1. No authentication because the network is private
  2. A single username and password reused across the fleet
  3. Mutual authentication using device-specific credentials Correct answer.
  4. Authentication based only on the device's MAC address

Explanation

Mutual authentication with per-device credentials lets both ends verify each other and supports revocation for a single device. Shared secrets, unauthenticated links and MAC-based trust are all easily spoofed or scaled into fleet-wide compromise.

Question 16Fundamental concepts and principles of IoT security

In ISO/IEC 27400, why is data minimization recommended for IoT devices that sense their environment?

  1. It allows encryption to be omitted for the remaining data
  2. It reduces storage costs for the cloud provider
  3. It removes the need for access control on collected data
  4. It limits privacy exposure and the impact of a data breach Correct answer.

Explanation

Collecting only what is needed reduces the personal or sensitive information at risk if a device or backend is compromised. It does not eliminate the need for access control or encryption on the data that is retained.

Question 17Fundamental concepts and principles of IoT security

A team wants to test an IoT security control by simulating a compromised sensor on the production network. Which ISO/IEC 27400-aligned safeguard should be applied first?

  1. Run the test during peak hours to observe realistic load
  2. Disable monitoring during the test to avoid false alarms
  3. Notify no one so that the test reflects genuine attacker conditions
  4. Obtain authorization and define scope, rules of engagement and rollback before testing Correct answer.

Explanation

Security testing of live IoT environments requires explicit authorization, a defined scope, agreed rules of engagement and a rollback plan so that safety and operations are protected. Unannounced or disruptive testing risks harm and invalidates trust.

Question 18Fundamental concepts and principles of IoT security

Which governance arrangement best supports ISO/IEC 27400 security objectives across a large IoT deployment?

  1. Delegating all device security to the procurement department alone
  2. Relying on device vendors to manage all operational risk
  3. Assigning clear security roles and responsibilities for devices across their lifecycle Correct answer.
  4. Treating security as a one-off project completed at deployment

Explanation

Clear ownership and defined responsibilities ensure that design, operation and decommissioning tasks are actually performed. One-off projects and single-department ownership leave gaps, and vendors cannot carry the operator's risk.

Question 19Fundamental concepts and principles of IoT security

An organization retires a batch of IoT sensors containing stored credentials and cached data. Which ISO/IEC 27400-aligned decommissioning step is most important?

  1. Removing the sensors from the asset inventory before wiping them
  2. Returning the sensors to the supplier without any data removal
  3. Reusing the sensors with their existing credentials to save time
  4. Sanitizing stored data and revoking device credentials and certificates Correct answer.

Explanation

Decommissioning must remove residual data and invalidate credentials so a retired device cannot be used to access live systems. Inventory removal, unscrubbed returns and credential reuse all leave exploitable material behind.

Question 20Fundamental concepts and principles of IoT security

Which monitoring approach best fits the ISO/IEC 27400 principle of detecting anomalous IoT device behaviour?

  1. Reviewing device logs once a year during the audit
  2. Waiting for users to report unusual device behaviour
  3. Establishing baselines of normal device traffic and alerting on significant deviations Correct answer.
  4. Relying solely on antivirus software installed on the devices

Explanation

Behavioural baselines allow deviations such as unexpected destinations or traffic volumes to be detected promptly. Annual review, endpoint antivirus and user reports are too slow or unsuitable for constrained IoT devices.

Question 21Fundamental concepts and principles of IoT security

Why does ISO/IEC 27400 emphasize defining security requirements during device selection and procurement rather than after deployment?

  1. Because procurement staff are the only personnel trained in security
  2. Because deployed devices cannot be monitored for security events
  3. Because suppliers refuse to discuss security after a contract is signed
  4. Because requirements are cheaper to specify than to retrofit into deployed devices Correct answer.

Explanation

Security capabilities are far easier and less costly to require before purchase than to add to devices already installed in the field. The other statements are false generalizations about personnel, monitoring and supplier behaviour.

Question 22Fundamental concepts and principles of IoT security

A device supports remote firmware updates but does not verify the signature of the update package. Which ISO/IEC 27400 concern is most directly raised?

  1. The device may consume too much power during the update
  2. The update server may run out of storage capacity
  3. The update process may deliver malicious or corrupted firmware to the device Correct answer.
  4. The device clock may drift during the update window

Explanation

Without signature verification, an attacker who can reach the update channel could install arbitrary firmware. Power, storage and clock issues are operational concerns but do not compromise firmware authenticity.

Question 23Fundamental concepts and principles of IoT security

Which statement best reflects ISO/IEC 27400 guidance on the use of default accounts and passwords on IoT devices?

  1. Default credentials should be changed or eliminated before devices are exposed to any network Correct answer.
  2. Default credentials should be documented in a public knowledge base
  3. Default credentials are acceptable if the device is behind a firewall
  4. Default credentials are safe when the device uses a non-standard port

Explanation

Default credentials are widely known and are a primary route for IoT compromise, so they must be removed or changed before exposure. Firewalls, non-standard ports and public documentation do not make shared defaults safe.

Question 24Fundamental concepts and principles of IoT security

An organization must choose between two sensors: one with strong encryption but no update capability, and one with basic encryption and a supported secure update path. Applying ISO/IEC 27400 reasoning, which consideration should weigh most heavily?

  1. The number of encryption algorithms supported by the device
  2. The strength of encryption alone, because cryptography determines overall security
  3. The brand recognition of the sensor manufacturer
  4. The ability to remediate future vulnerabilities over the device lifetime Correct answer.

Explanation

No device is free of future vulnerabilities, so the ability to receive secure updates over its lifetime is decisive for long-lived deployments. Strong cryptography today cannot compensate for an inability to fix flaws discovered tomorrow.

Question 25Fundamental concepts and principles of IoT security

Which measure best reflects ISO/IEC 27400 guidance on protecting data at rest on an IoT device that may be stolen?

  1. Encrypting stored data and protecting the keys outside plaintext firmware Correct answer.
  2. Relying on the device enclosure lock as the only protection
  3. Storing credentials in a shared configuration file on the device
  4. Storing data in plaintext so that recovery after failure is simpler

Explanation

Encryption of stored data, with keys protected separately from the firmware image, limits the value of a stolen device. Plaintext storage, physical locks alone and shared configuration files all leave data and credentials recoverable.

Question 26Fundamental concepts and principles of IoT security

ISO/IEC 27400 describes IoT security in terms of a set of risk sources that shape the whole lifecycle of a device. Which pairing of a risk source with its typical manifestation is consistent with the standard's framing?

  1. Data risk - encrypted telemetry is by definition free of privacy exposure
  2. Lifecycle risk - devices in service for many years need no maintenance planning
  3. Network risk - a device with no radio interface cannot be attacked remotely
  4. Physical interaction risk - a device left in a public space can be opened and its debug port used Correct answer.

Explanation

ISO/IEC 27400 treats physical accessibility as a distinct risk source, because many IoT devices sit in uncontrolled spaces where ports, storage and reset mechanisms can be reached by an attacker. The other pairings contradict the standard's view that risks arise across physical, network, data and lifecycle dimensions simultaneously.

Question 27Fundamental concepts and principles of IoT security

Which statement best captures the ISO/IEC 27400 view of who bears responsibility for IoT security?

  1. Responsibility is limited to regulators, who define acceptable risk on behalf of everyone
  2. Responsibility rests solely with the end user, who must secure whatever is purchased
  3. Responsibility is shared across manufacturers, service providers and users, each acting on the risks within their control Correct answer.
  4. Responsibility rests solely with the manufacturer, since users cannot influence device behaviour

Explanation

ISO/IEC 27400 is written for a broad audience and distributes responsibility along the value chain: manufacturers build security in, service providers operate and integrate, and users configure and maintain. No single party can control all risk sources, so the guidance assigns obligations where each actor has leverage.

Question 28Fundamental concepts and principles of IoT security

A building operator plans to deploy environmental sensors in tenants' offices. Under ISO/IEC 27400, which consideration belongs to the earliest conceptual stage of this deployment?

  1. Deciding what data the sensors must collect and which purposes justify that collection Correct answer.
  2. Choosing which staff member will respond to alerts after the first year of operation
  3. Deciding the retention period after the first data protection complaint arrives
  4. Selecting the ticketing tool used for incident records once devices are live

Explanation

The standard places purpose definition and data-need justification at the conceptual stage, because collection scope constrains every later design and procurement choice. Operational and tooling decisions follow once the purpose and data requirements are settled.

Question 29Fundamental concepts and principles of IoT security

Which characteristic of IoT devices most directly explains why ISO/IEC 27400 treats them differently from conventional IT equipment?

  1. They are replaced on the same refresh cycle as desktop computers
  2. They are exempt from network connectivity requirements
  3. They always run general-purpose operating systems with full local administration
  4. They often combine constrained computing resources with long field lifetimes and limited human oversight Correct answer.

Explanation

ISO/IEC 27400 highlights the combination of resource constraints, long deployment lifetimes and unattended operation, which limits the security controls that can be applied and makes update planning critical. Conventional IT assumptions about frequent refresh and present administrators do not transfer to such devices.

Question 30Fundamental concepts and principles of IoT security

An organization wants to apply ISO/IEC 27400's risk-based approach to a mixed estate of cameras, meters and controllers. Which action best demonstrates that approach?

  1. Adopting the controls of the most secure device class for the entire estate without further analysis
  2. Deferring control selection until an incident reveals which devices are actually at risk
  3. Applying an identical control set to every device regardless of function or exposure
  4. Assessing each device class for likelihood and impact of harm, then selecting controls proportionate to that assessment Correct answer.

Explanation

A risk-based approach means identifying the risks that apply to each device class and choosing controls in proportion to the resulting likelihood and impact. Uniform control sets ignore differing exposure and function, while waiting for incidents is reactive rather than risk-based.

Question 31Fundamental concepts and principles of IoT security

In ISO/IEC 27400, what is the primary purpose of maintaining an inventory of IoT devices and their attributes?

  1. To satisfy a one-time documentation requirement at the start of a project
  2. To enable identification of affected devices, ownership and dependencies when vulnerabilities or incidents arise Correct answer.
  3. To replace the need for network monitoring of device behaviour
  4. To record purchase prices for financial reporting purposes

Explanation

Inventory is treated as an operational enabler: knowing what devices exist, who owns them and what they depend on allows rapid scoping of vulnerabilities and incidents. It is a living record rather than a one-off document, and it complements rather than replaces monitoring.

Question 32Fundamental concepts and principles of IoT security

A product team argues that because their IoT device has no user interface, security configuration can be left entirely to the installer. How does ISO/IEC 27400 address this situation?

  1. Installers should be required to write custom scripts for each deployment
  2. Configuration security is irrelevant when a device has no screen or keyboard
  3. Security settings should be hidden from installers to prevent tampering
  4. Secure configuration should be achievable by default so that correct operation does not depend on installer expertise Correct answer.

Explanation

The standard expects devices to ship in a secure state and to be configurable without specialist knowledge, because reliance on installer skill produces inconsistent outcomes at scale. Absence of a user interface raises, rather than lowers, the need for secure defaults.

Question 33Fundamental concepts and principles of IoT security

Which statement reflects ISO/IEC 27400 guidance on how security requirements should be expressed in a procurement specification for IoT devices?

  1. As general aspirations such as 'the device should be secure' that vendors interpret freely
  2. As verifiable requirements tied to identified risks, so that compliance can be checked before acceptance Correct answer.
  3. As a list of features copied from a competitor's product brochure
  4. As optional notes that may be addressed after the devices are deployed

Explanation

Requirements are useful only if they can be verified and traced to identified risks, which allows acceptance testing and evidence-based selection. Vague aspirations cannot be checked and leave the buyer unable to distinguish compliant from non-compliant offers.

Question 34Fundamental concepts and principles of IoT security

An IoT deployment includes devices that will remain in service for a decade. Which ISO/IEC 27400-aligned planning decision follows most directly from that lifetime?

  1. Assuming that threats present at deployment will remain unchanged
  2. Freezing the device configuration permanently at installation
  3. Planning how security updates and vulnerability handling will be sustained for the full service life Correct answer.
  4. Removing logging capability to reduce long-term storage costs

Explanation

Long service life means the threat landscape will change many times, so the standard expects a sustained plan for updates and vulnerability handling across the whole life. Assuming a static threat picture or freezing configuration leaves the estate unable to respond.

Question 35Fundamental concepts and principles of IoT security

A team is defining logging for an IoT fleet. Which approach is most consistent with ISO/IEC 27400?

  1. Disable logging on constrained devices because storage is limited
  2. Log every byte of sensor payload indefinitely to maximize forensic value
  3. Log only successful administrative logins, since failures are noise
  4. Log security-relevant events with sufficient context to support detection and investigation, while limiting collection of unnecessary personal data Correct answer.

Explanation

The standard balances the need for security visibility against data minimization, so logs should capture security-relevant events with enough context for investigation without hoarding unnecessary personal data. Unlimited collection and blanket disabling are both extremes the guidance avoids.

Question 36Fundamental concepts and principles of IoT security

Which statement best describes how ISO/IEC 27400 treats the relationship between IoT security and privacy?

  1. Privacy concerns apply only to devices used in residential settings
  2. Privacy is achieved by collecting as much data as possible and securing it afterwards
  3. Privacy protection is a design objective supported by security measures such as minimization, access control and transparency Correct answer.
  4. Privacy is a legal matter entirely separate from the technical security guidance

Explanation

The standard integrates privacy into IoT security design, treating minimization, access control and transparency as technical means of supporting privacy objectives. It does not treat privacy as purely legal or as confined to consumer contexts.

Question 37Fundamental concepts and principles of IoT security

An organization discovers that a supplier's IoT component includes third-party libraries of unknown origin. Which ISO/IEC 27400-aligned response is most appropriate?

  1. Accept the situation because libraries are always benign if the device passes functional testing
  2. Require component transparency and track the third-party elements so vulnerabilities can be traced and remediated Correct answer.
  3. Replace the component immediately without further analysis
  4. Document the libraries once and treat the record as final

Explanation

The standard expects visibility into the composition of IoT products so that vulnerabilities in third-party elements can be identified and remediated over time. Functional testing does not reveal security provenance, and a static record becomes obsolete as libraries change.

Question 38Fundamental concepts and principles of IoT security

Two departments disagree about whether a particular IoT control is needed. Which ISO/IEC 27400-aligned mechanism best resolves such disagreements consistently across an organization?

  1. Adopting whichever option costs least in the current budget cycle
  2. Letting each department decide independently according to local preference
  3. Escalating every decision to the device vendor for a recommendation
  4. A documented security policy that assigns roles and sets risk acceptance criteria for IoT systems Correct answer.

Explanation

The standard positions policy and governance as the means of consistent, accountable decisions, with defined roles and criteria for accepting risk. Departmental autonomy, vendor deference and cost-only reasoning all produce inconsistent treatment of comparable risks.

Question 39Fundamental concepts and principles of IoT security

During integration testing, a gateway is found to forward device data to an unauthenticated cloud endpoint. Which ISO/IEC 27400 principle does this most directly violate?

  1. Devices and gateways should authenticate the endpoints and services they communicate with Correct answer.
  2. Devices should be retired securely at end of life
  3. Devices should be physically protected against tampering
  4. Devices should minimize the amount of data they store locally

Explanation

Forwarding data to an unauthenticated endpoint means the gateway cannot verify who receives the data, which breaks the principle that communicating parties and services must be authenticated. Storage minimization, physical protection and retirement are separate concerns not exercised by this finding.

Question 40Fundamental concepts and principles of IoT security

An organization must decide how much autonomy to grant an automated IoT control system that can physically affect its environment. Which ISO/IEC 27400 consideration is most relevant?

  1. The potential for harm means human oversight and fail-safe behaviour should be designed in proportion to the consequences Correct answer.
  2. Physical effects are outside the scope of IoT security guidance
  3. Autonomy should be maximized because automated systems are inherently more reliable than people
  4. Safety considerations should be deferred until after the security architecture is complete

Explanation

Where IoT systems can cause physical effects, the standard expects security design to account for safety consequences, including appropriate human oversight and fail-safe behaviour. Treating safety as a later add-on or as out of scope ignores the interdependence the guidance emphasizes.

Question 41ISO/IEC 27400 IoT security controls and risk management

In ISO/IEC 27400, which statement best describes the relationship between IoT devices and conventional IT assets for risk assessment purposes?

  1. IoT devices should be excluded from enterprise risk registers until a formal patch cycle exists
  2. IoT devices present identical risk profiles to laptops and can reuse the same control baselines unchanged
  3. IoT devices require their own risk considerations because of unattended operation, long lifetimes and physical accessibility Correct answer.
  4. IoT devices are covered automatically by existing IT risk assessments once network segmentation is applied

Explanation

ISO/IEC 27400 treats IoT systems as distinct because they typically run unattended, remain in service for many years and are physically reachable by attackers. These characteristics change both likelihood and impact, so they need dedicated risk analysis rather than automatic inheritance from IT baselines.

Question 42ISO/IEC 27400 IoT security controls and risk management

Which characteristic of IoT devices most directly complicates the application of routine software patching controls?

  1. Use of wireless communication protocols
  2. Deployment inside data centres
  3. Reliance on cloud dashboards
  4. Limited processing, memory and energy budgets Correct answer.

Explanation

Many IoT endpoints cannot host full update agents or spare the compute and power needed for frequent patching, which delays fixes for known vulnerabilities. This resource constraint is the primary reason the standard treats update management for IoT as a tailored control area.

Question 43ISO/IEC 27400 IoT security controls and risk management

An organisation plans to deploy smart building sensors that will remain in place for a decade. According to ISO/IEC 27400 guidance, which planning activity should begin at procurement?

  1. Requiring each sensor to run a full host intrusion detection agent
  2. Scheduling annual penetration tests of each sensor
  3. Defining end-of-life and decommissioning provisions, including data removal Correct answer.
  4. Migrating all sensor data to a single central database

Explanation

Long-lived IoT deployments need lifecycle planning from the start, including how devices will be retired and how stored data will be erased. The standard highlights end-of-life handling because devices often outlast the vendor support window.

Question 44ISO/IEC 27400 IoT security controls and risk management

What is the primary purpose of maintaining an inventory of IoT devices in an ISO/IEC 27400 aligned programme?

  1. To replace the need for network segmentation
  2. To satisfy marketing claims about product quality
  3. To reduce the number of suppliers under contract
  4. To enable identification of assets requiring updates, monitoring and access review Correct answer.

Explanation

An accurate inventory is the foundation for knowing which devices exist, what firmware they run and who may access them. Without it, patching, monitoring and access reviews cannot be scoped reliably.

Question 45ISO/IEC 27400 IoT security controls and risk management

Which control area of ISO/IEC 27400 addresses the risk that an attacker with physical access extracts credentials from a device?

  1. Service continuity management
  2. Physical and environmental security Correct answer.
  3. Application layer security
  4. Identity federation

Explanation

Physical and environmental security covers tamper resistance, protection of interfaces and securing devices in accessible locations. Credential extraction through physical access is a physical-layer threat, so that control area applies.

Question 46ISO/IEC 27400 IoT security controls and risk management

In an ISO/IEC 27400 risk assessment, why should the communication network of an IoT system be analysed separately from the devices themselves?

  1. Devices cannot be assessed without a firewall
  2. Network paths introduce threats such as interception, spoofing and denial of service that differ from device threats Correct answer.
  3. Networks are always owned by third parties
  4. Network analysis replaces the need for device authentication

Explanation

The communication layer has its own threat profile, including eavesdropping, message spoofing and traffic flooding, which are distinct from on-device weaknesses. Assessing it separately ensures these threats are identified and matched to appropriate controls.

Question 47ISO/IEC 27400 IoT security controls and risk management

Which practice best reflects the ISO/IEC 27400 principle of secure default configuration for IoT devices?

  1. Shipping devices with unique credentials and unnecessary services disabled Correct answer.
  2. Shipping devices with a shared administrative password to simplify setup
  3. Enabling all remote management services so integrators have flexibility
  4. Deferring security settings until the first firmware update

Explanation

Secure defaults mean devices leave the factory with unique credentials and only the services needed for their function enabled. This removes the common weakness of shared passwords and exposed services that users rarely change.

Question 48ISO/IEC 27400 IoT security controls and risk management

An organisation is selecting controls for a fleet of environmental monitors. Which approach does ISO/IEC 27400 recommend for matching controls to identified risks?

  1. Applying every available control uniformly to all devices
  2. Copying the control set used for office workstations
  3. Adopting controls only after an incident occurs
  4. Selecting controls proportionate to the assessed risk and device constraints Correct answer.

Explanation

The standard follows a risk-based approach in which controls are chosen according to assessed risk and feasibility on the device. Uniform application of all controls is neither practical nor required.

Question 49ISO/IEC 27400 IoT security controls and risk management

A hospital deploys infusion pumps with network connectivity. Risk analysis shows that a compromised pump could directly harm patients. How should the risk be treated first under an ISO/IEC 27400 approach?

  1. Defer treatment until the next annual review cycle
  2. Prioritise treatment because impact on safety is severe, then select layered technical and procedural controls Correct answer.
  3. Accept the risk because the pumps are certified medical devices
  4. Transfer the risk entirely to the device manufacturer

Explanation

Where IoT risk extends to physical safety, the impact is severe and treatment should be prioritised. The standard expects layered controls, combining technical measures with operational procedures, rather than relying on certification alone.

Question 50ISO/IEC 27400 IoT security controls and risk management

An engineer proposes using the same symmetric key across 5,000 deployed sensors to simplify provisioning. Which ISO/IEC 27400 concern is most directly raised?

  1. Symmetric algorithms are unsuitable for IoT
  2. Key rotation will become impossible
  3. The key will be too long for constrained devices
  4. Compromise of one device exposes the entire fleet Correct answer.

Explanation

Shared keys create a single point of failure: extracting the key from one device compromises every device using it. The standard favours per-device credentials so that a compromise remains contained.