Free ITS-110 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Injection attacks, such as SQL injection or Cross-Site Scripting (XSS), occur when an attacker sends malicious data to an application, which is then processed or executed. The most effective mitigation technique is parameter validation, also known as input validation. This practice involves rigorously checking all data received from a user or external source to ensure it conforms to strict rules for type, length, format, and content. By validating that input is safe and expected before it is used, the application can reject malicious payloads, preventing them from being interpreted as commands or executable code by a backend system.

A. Configure single sign-on (SSO): This is an authentication mechanism that improves user experience but does not inspect or sanitize the content of user input to prevent injection attacks.

C. Require strong passwords: This is an authentication control measure that makes user accounts harder to compromise through guessing or brute force, but it is unrelated to validating application input.

D. Require two-factor authentication (2FA): This enhances authentication security by requiring a second verification factor, but it does not protect the application from malicious input submitted by an authenticated user.

1. OWASP Foundation. (2021). OWASP Top 10:2021. A03:2021-Injection. In the "How to Prevent" section

the primary recommendation is to "Use a safe API

which avoids using the interpreter entirely or provides a parameterized interface

" followed by server-side input validation. This directly supports parameter validation as a key defense. Retrieved from https://owasp.org/Top10/A032021-Injection/

2. Zeldovich

N.

& Kaashoek

F. (2014). 6.858 Computer Systems Security

Fall 2014. MIT OpenCourseWare. Lecture 15: Web Security

Slides 20-23. The lecture explicitly identifies "Check user input" (input validation) and using "prepared statements" (a form of parameterization) as the primary defenses against SQL injection attacks.

3. Scarfone

K.

Souppaya

M.

& Cody

A. (2007). Guide to Secure Web Services (NIST Special Publication 800-95). National Institute of Standards and Technology. Section 5.3

"Input Validation

" states

"Input validation should be performed to ensure that all input is well-formed and trustworthy... This is a defense against many types of attacks

including... SQL injection." (p. 5-4). DOI: https://doi.org/10.6028/NIST.SP.800-95

The question asks which attack is NOT a method to steal data from the connection between a web application and an IoT endpoint. SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) are all viable attack vectors against a web application. SQLi and XSS are direct methods for data exfiltration from the database and user's browser, respectively. CSRF can be used to trick an authenticated user's browser into performing an action that sends data to an attacker.

LDAP Injection, however, is a highly specific attack that targets applications using an LDAP (Lightweight Directory Access Protocol) server for directory services, primarily user authentication and information. The transactional data exchanged between a web application and an IoT endpoint is typically stored in a relational (SQL) or NoSQL database, not an LDAP directory. Therefore, an LDAP Injection attack would not be a relevant method for stealing this specific data.

A. Cross-Site Request Forgery (CSRF): This attack can force a user's browser to execute a request that sends data to an attacker-controlled location, thus facilitating data theft.

B. SQL Injection (SQLi): This is a primary and highly effective method for attacking the application's backend database to read, modify, or exfiltrate sensitive data.

C. Cross-Site Scripting (XSS): This attack injects malicious scripts into the web application, which can then be used to steal user session cookies, credentials, or other sensitive data from the user's browser.

1. OWASP Foundation

"LDAP Injection Prevention Cheat Sheet." This document specifies that LDAP injection targets applications that use LDAP queries. It states

"LDAP injection is an attack used to exploit web applications that construct LDAP statements from user input." This highlights its specificity to LDAP backends

which are distinct from the typical databases used for application data. (Reference: OWASP LDAP Injection Prevention Cheat Sheet

Introduction section).

2. OWASP Foundation

"Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet." This resource describes CSRF as an attack that "forces an end user to execute unwanted actions." While primarily for performing actions

a crafted request can cause data to be sent to an attacker

making it a method to facilitate data theft. (Reference: OWASP Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet

Introduction section).

3. Martin

M.

et al. (2012). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology: MIT OpenCourseWare. Lecture 13

"Web Security

" details how SQL Injection and Cross-Site Scripting are used to exfiltrate data from databases and user sessions

respectively. It establishes them as common data theft vectors in web applications. (Reference: MIT OCW

6.858

Fall 2014

Lecture 13 Notes

Sections 3 & 4).

Network filters that rely on Ethernet burned-in addresses, more commonly known as Media Access Control (MAC) addresses, operate by maintaining an access control list of approved hardware addresses. The fundamental vulnerability of this security measure is that MAC addresses can be easily altered in software. An attacker can monitor network traffic to discover the MAC address of an authorized device and then reconfigure their own network interface to use, or "spoof," that address. This allows the attacker's device to impersonate the legitimate one, thereby bypassing the filter entirely.

B. Buffer overflow: This is a software vulnerability where a process overwrites memory boundaries. It is unrelated to bypassing network layer 2 hardware address filters.

C. Packet injection: While an attacker might inject packets after spoofing a MAC address, packet injection itself is a broader attack and not the specific vulnerability of the MAC filter.

D. GPS spoofing: This attack involves broadcasting false GPS signals to deceive location-aware devices. It has no relevance to MAC address-based network access control.

1. National Institute of Standards and Technology (NIST). (2012). Guidelines for Securing Wireless Local Area Networks (WLANs) (NIST Special Publication 800-153). Section 4.2.1

"MAC Address Filtering

" states

"However

because MAC addresses are sent in the clear

an attacker can easily spoof the MAC address of an authorized client."

2. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8.3

"Securing Wireless LANs

" the text explains that MAC filtering is a weak security measure because "the intruder can learn the MAC addresses of stations that are associated with the AP... and then have his or her station pretend to be one of these stations by spoofing its MAC address."

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 17

"Wireless Network Security

" discusses the security flaws of early Wi-Fi standards

noting that MAC address filtering is easily defeated by sniffing a valid MAC address and then spoofing it.

Resetting an IoT gateway to its factory defaults is a fundamental security best practice before deployment and integration. This process, often called device hardening, ensures the device is in a known, clean state. It erases any non-standard configurations, user accounts, or potential malware that might have been introduced between manufacturing and deployment. By starting from a trusted baseline, the integrator can then proceed to apply a secure configuration, such as creating strong credentials and disabling unnecessary services, thereby minimizing the initial risk profile of the device before it connects to the cloud.

A. Write down the default login and password

This action documents a known, high-risk vulnerability. Security best practices mandate changing default credentials immediately, not recording them for use.

B. Remove all logins and passwords that may exist

This is not a standard or feasible procedure. Devices require administrative accounts for configuration, and attempting to remove all credentials could render the device inaccessible.

C. Create new credentials using a strong password

While this is a critical security step, it should be performed after a factory reset. A reset ensures the underlying system is not already compromised, making the new credentials secure.

---

1. National Institute of Standards and Technology (NIST). (2021). IoT Device Cybersecurity Guidance for the Federal Government. NIST Special Publication 800-213A. In Section 3.2.1

"Device Configuration

" the guidance states

"Organizations should establish and implement a process for configuring IoT devices to a standardized

secure baseline before they are deployed." A factory reset is the primary method to return a device to its original baseline state

from which secure configurations can be applied.

(DOI: https://doi.org/10.6028/NIST.SP.800-213A)

2. European Union Agency for Cybersecurity (ENISA). (2020). Guidelines on Securing the IoT - Secure Software Development Lifecycle. In Section 5.3

"Secure deployment and maintenance

" the document emphasizes the need for a secure initial state. It states

"The device should be in a secure state when delivered to the customer... This includes having a procedure to reset the device to a secure state (e.g. factory reset)." This highlights the factory reset as a core mechanism for ensuring a secure starting point.

(Reference: Page 29

Section 5.3)

3. Carnegie Mellon University

Software Engineering Institute. (2019). SEI-CMU IoT Security and Privacy Checklist. The checklist for "Device Integrator/Operator" includes the step: "Change all default passwords and configuration settings on the device." To ensure all settings are known and secure

starting from a factory default state is the most reliable method before applying new

secure configurations.

(Reference: "Device Integrator/Operator Checklist

" Item 1)

The question addresses the need to protect a cloud portal from compromised credentials. The most effective control for this threat is Multi-Factor Authentication (MFA). Option C describes a standard MFA implementation, combining two distinct authentication factors: "something you know" (the strong password) and "something you have" (the mobile device that receives the SMS token). If an attacker compromises the password, they would still need physical access to the user's phone to complete the login, thus protecting the account.

A. This is multi-step authentication, not multi-factor. Both credentials are passwords, which fall under the same factor type: "something you know."

B. A strong password policy hardens the credential itself but does not protect against its compromise through methods like phishing, keylogging, or credential stuffing.

D. This uses two tokens from a single hardware device, representing only one factor type: "something you have." This does not meet the definition of multi-factor authentication.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management.

Section 5.1

"Authenticator and Verifier Requirements

" states: "Multi-factor authentication (MFA) requires at least two of the three factor types to be used for a successful authentication event." It defines these types as something you know

something you have

and something you are. This supports option C as the only true MFA implementation.

2. Amazon Web Services (AWS). (2023). Security best practices in IAM. AWS Identity and Access Management Documentation.

In the section "Require multi-factor authentication (MFA)

" the documentation states: "For extra security

we recommend that you require MFA for all IAM users... With MFA

users have a user name and password (the first factor—what they know)

and an authentication code from their AWS MFA device (the second factor—what they have)." This directly applies to securing a cloud portal.

3. Rivest

R. L. (2014). Lecture 15: Authentication. MIT OpenCourseWare

6.857 Computer and Network Security.

The lecture notes discuss authentication methods

highlighting that passwords ("what you know") can be stolen. It introduces two-factor authentication as a solution combining passwords with a token ("what you have") to mitigate this risk

directly aligning with the logic in option C.

The scenario describes a classic case of Domain Name System (DNS) poisoning, also known as DNS spoofing. In this attack, a malicious actor corrupts the data in a DNS server's cache, causing it to return an incorrect IP address for a legitimate domain name. When the administrator attempts to navigate to the administrative website, their system queries the compromised DNS server, which then resolves the domain to the IP address of the fake website. This effectively redirects the user's traffic to the attacker-controlled site without their knowledge, matching the described outcome perfectly.

A. Buffer overflow: This is a memory-based vulnerability exploitation technique used to execute arbitrary code or crash a system, not to redirect network traffic via domain names.

B. Denial of Service (DoS): This type of attack aims to make a network resource or website unavailable to its intended users, typically by flooding it with traffic, rather than redirecting users to a different site.

C. Birthday attack: This is a cryptographic attack that exploits probability theory to find collisions in hash functions, primarily used for forging digital signatures, and is unrelated to website redirection.

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 21.5

"DNS Attacks

" the text describes DNS poisoning as an attack where "an attacker is able to intercept a DNS request and reply with a forged DNS response... The forged response redirects the user to a different Web site."

2. Kuhrer

M.

Hupperich

T.

Holz

T.

& Rossow

C. (2014). Going Wild: Large-Scale Classification of Open DNS Resolvers. In Proceedings of the 2014 Conference on Internet Measurement Conference (IMC '14). Association for Computing Machinery

New York

NY

USA

233–246. The paper discusses DNS vulnerabilities

stating

"An attacker can poison the cache of a DNS resolver to redirect clients to a malicious server" (Section 2.1

DNS Cache Poisoning). DOI: https://doi.org/10.1145/2663716.2663733

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Lecture 15: Network Security. Massachusetts Institute of Technology. The lecture notes explain DNS spoofing: "Goal: get victim to talk to a malicious server

by sending a fake DNS reply with a bad IP address." (Section 3

DNS Spoofing).

4. National Institute of Standards and Technology (NIST). (2010). NIST Special Publication 800-81-2: Secure Domain Name System (DNS) Deployment Guide. Section 2.2

"DNS Vulnerabilities

" details how cache poisoning allows an attacker to "redirect unsuspecting users to a malicious Web site."

Secure boot is a security process that establishes a root of trust. It ensures that each component loaded during the boot sequence, from the initial bootloader to the operating system kernel, is cryptographically signed and verified. If the digital signature of any component is invalid or untrusted, the boot process is halted. This mechanism directly prevents the IoT gateway from loading and executing unauthorized or malicious firmware images, thereby achieving the engineer's goal of only loading verified software.

A. Implement Over-The-Air (OTA) updates: This is a method for delivering firmware updates, not a mechanism for verifying the integrity of the image during the device's boot process.

C. Enforce a measured boot function: Measured boot records cryptographic hashes of boot components into a Trusted Platform Module (TPM) for later attestation but does not inherently prevent an unverified image from loading.

D. Harden the update server: This is a crucial server-side security measure but does not protect the gateway itself from loading a malicious image obtained through other channels (e.g., physical access).

1. Sadeghi

A.-R.

Wachsmann

C.

& Waidner

M. (2015). "Security and Privacy Challenges in Industrial Internet of Things." 52nd ACM/EDAC/IEEE Design Automation Conference (DAC). In Section III.A

"Trusted Platform

" the paper emphasizes that a secure boot process is fundamental to establishing a trusted computing base on an IoT device by verifying the authenticity and integrity of firmware. DOI: 10.1145/2744769.2747942.

2. NXP Semiconductors. (2021). AN4581: HABv4 Secure Boot on i.MX 6/7 Series. In Section 2

"High Assurance Boot (HAB) Introduction

" p. 5

it is stated that "HAB allows customers to sign their boot images... On every boot

the i.MX processor authenticates the image signature. If the authentication fails

the boot is terminated." This directly describes the function of secure boot.

3. Stancill

B. (2021). Building a Secure Boot Chain for an IoT Device. Courseware

University of Colorado Boulder. In the "Secure Boot" section

the material explains that the process creates a "chain of trust" where each stage verifies the next

ensuring "that the device is running authentic software."

This attack is a form of vishing, which is a portmanteau of "voice" and "phishing." Vishing attacks use voice communication technology, such as a phone call or voicemail, to conduct phishing. In this scenario, the attacker leaves a fraudulent voicemail, impersonating a legitimate company to deceive the recipient into revealing sensitive financial information (a credit card number). The use of a voice message as the attack vector is the defining characteristic of vishing, making it the most accurate and specific answer.

A. Phishing: This is a general term for attacks seeking sensitive information via electronic communication. Vishing is a more specific and accurate description of this voice-based attack.

B. Spear phishing: This describes a targeted attack, which this is, as it references a recent purchase. However, "vishing" is more precise as it specifically identifies the voice-based medium used.

C. Whaling: This is a type of spear phishing that specifically targets high-profile individuals like executives or celebrities. The scenario does not indicate the victim is a high-value target.

1. National Institute of Standards and Technology (NIST). Glossary of Key Information Security Terms

NISTIR 7298 Rev. 3. Page 207. "Vishing: A type of phishing attack that is conducted over the phone

using voice technology (e.g.

a phone call or voice message)."

This source also defines spear phishing (p. 178) as a targeted attack and whaling (p. 210) as targeting high-profile individuals

supporting the distinctions made above.

2. Purdue University. Information Security and Policy

Social Engineering. "Vishing is another type of phishing attack that is conducted by phone... Spear phishing is a more targeted phishing attack. The attacker finds out information about the target..."

This university resource clearly distinguishes the terms

defining vishing by its voice medium and spear phishing by its targeted nature. The scenario's most explicit detail is the voice message

making vishing the most precise classification.

3. Carnegie Mellon University

Software Engineering Institute (SEI). Common Social Engineering Attacks. "Vishing

or voice phishing

is the use of telephony... to trick individuals into revealing sensitive information."

This further solidifies the definition of vishing as an attack conducted over voice channels

directly matching the scenario described.

Hashing is the correct technique for this purpose. A hash function creates a unique, fixed-length digital fingerprint (a "hash" or "digest") of a file. The developer can compute the hash of the original software and publish it. Users can then download the software, compute the hash on their end using the same algorithm (e.g., SHA-256), and compare it to the one provided by the developer. If the hashes match, the user can be confident the software has not been modified. This process ensures data integrity.

A. Encryption: Encryption is used for confidentiality to make data unreadable to unauthorized parties, not primarily to verify that the data has not been altered.

B. Obfuscation: This technique makes code difficult for humans to read or reverse-engineer but does not provide a verifiable method to detect modifications.

D. Fuzzing: Fuzzing is a software testing method used to find vulnerabilities by inputting random data; it is not a tool for end-users to verify file integrity.

1. National Institute of Standards and Technology (NIST)

Special Publication 800-183

Networks of 'Things'

July 2016. Section 3.3.2

"Data Confidentiality

Integrity

and Origin Authentication

" discusses the need for data integrity and mentions cryptographic mechanisms like digital signatures

which are fundamentally based on hashing

to ensure data has not been altered.

2. CertNexus

ITS-110 Exam Objectives

Version 2.0. Domain 3.3

"Given a scenario

implement security measures for IoT devices

" covers the application of cryptographic controls. Hashing is a primary cryptographic control used to ensure the integrity of data and software.

3. Paar

C.

& Pelzl

J.

Understanding Cryptography: A Textbook for Students and Practitioners. (Material commonly used in university curricula). Chapter 11

"Hash Functions

" Section 11.1.2

"Digital Signatures

" explains that a core application of hash functions is to compute a short digest of a message or file for integrity verification as part of a digital signature scheme.

4. University of California

Berkeley

CS 161: Computer Security Course Notes

Fall 2020. Lecture 8: "Cryptographic Hash Functions

" page 2

explicitly states: "A major application of cryptographic hash functions is to verify file integrity." It details the exact process described in the explanation.

A session replay attack occurs when an attacker intercepts and records a valid data transmission (e.g., an authentication sequence or command) and then re-transmits it later to impersonate the legitimate device. By requiring a unique, randomly generated token (often called a nonce or "number used once") for each new connection or session, the system ensures that any captured transmission becomes invalid for future use. When the attacker replays the old message, the server will reject it because the token has already been used or has expired, thus effectively mitigating the replay attack.

A. Malformed URL injection: This is primarily mitigated by input validation and sanitization on the server-side, not by session tokens.

B. Buffer overflow: This is a memory corruption vulnerability prevented by secure coding practices like bounds checking, not by application-layer tokens.

C. SSL certificate hijacking: This is mitigated by strong Public Key Infrastructure (PKI) management, certificate pinning, and secure key storage, not by session tokens.

---

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines

Authentication and Lifecycle Management.

Section 4.3.3

Replay Resistance: "The verifier SHALL implement a mechanism that is resistant to replay attacks... Common mechanisms for replay resistance include nonces

timestamps

or the use of challenges." This directly links the use of nonces (randomly generated tokens) to the prevention of replay attacks.

2. Perrig

A.

Canetti

R.

Tygar

J. D.

& Song

D. (2002). The TESLA Broadcast Authentication Protocol. RSA CryptoBytes

5(2).

Section 2

Basic TESLA: "To prevent replay attacks

the receiver needs to check that the MAC key... has not been disclosed yet." While discussing a specific protocol

the underlying principle of using time-sensitive or single-use cryptographic material to prevent replays is a foundational concept in network security academic literature. The use of a unique token serves a similar purpose.

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Chapter 8

Security in Computer Networks: In discussions on authentication protocols (e.g.

Section 8.3)

the text explains the use of a nonce to defend against replay attacks. It states that by having a party send a nonce and requiring it to be returned (often in an encrypted form)

the party can verify the message is fresh and not a replay. This is a standard university-level textbook.

Unprotected shell access via a console port (such as UART) provides an attacker with direct, often privileged, command-line control over the device's operating system. This level of access is one of the most critical vulnerabilities as it allows the attacker to execute arbitrary commands. The most significant and direct risk from this capability is the ability to download and execute malicious software. This allows an attacker to install persistent malware, enroll the device in a botnet (e.g., Mirai), exfiltrate data, or use the compromised device as a pivot point to attack other systems on the internal network.

A. Directory harvesting: This is an information-gathering technique to find valid resource names. While possible with shell access, it is a far less severe risk than complete system compromise via malware.

B. Rainbow table attacks: These attacks are used to crack password hashes. The scenario specifies "unprotected" access, meaning no authentication is required, rendering this attack method irrelevant for gaining initial access.

D. Buffer overflow: This is a type of software vulnerability that could be used to gain shell access. It is a cause, not a direct risk or consequence of already having unprotected access.

1. Neshenko

N.

Bou-Harb

E.

Crichigno

J.

Kaddoum

G.

& Ghani

N. (2019). A Survey on IoT Security: Challenges

Approaches

and New Trends. IEEE Access

7

14307-14326. DOI: https://doi.org/10.1109/ACCESS.2019.2915748.

In Section IV-A

"Physical Layer Attacks

" the paper states: "Attackers can also get a root shell on the device through the UART interface. With root access

attackers can do anything they want

such as installing malicious software or stealing sensitive information." This directly links unprotected shell access via physical ports to the risk of malware installation.

2. OWASP Foundation. (2018). OWASP Internet of Things Top 10 - 2018. OWASP.

Reference vulnerability "I8:2018-Insecure Default Settings" discusses how devices may ship with insecure settings

such as open debugging ports that provide shell access. The document notes that the impact of exploitation is "a full compromise of the device

" which is typically achieved by installing malicious code to maintain control and carry out further attacks.

The security of a Public Key Infrastructure (PKI) system, which uses X.509 certificates, is fundamentally based on the secrecy of the private key. To spoof a device's management portal with a trusted certificate, an attacker must possess the corresponding private key. If this key is stored in an unsecure, readable location like non-volatile flash memory without proper encryption or hardware protection (e.g., a Trusted Platform Module or Secure Element), an attacker can extract it. With the private key, the attacker can impersonate the device, decrypt traffic, and successfully spoof its identity to clients.

A. Bootloader code is stored in unsecure flash memory: This is a critical vulnerability that can lead to a full system compromise, but it is an indirect cause. The attacker would first need to exploit this to then access the private key.

B. The portal's certificate is stored in unsecure flash memory: The certificate contains the public key and is, by design, public information. Storing it in an unsecure location does not create a vulnerability for spoofing.

D. Firmware is loaded from flash using unsecure object references: This vulnerability could allow an attacker to load malicious firmware, but like the bootloader issue, it is a potential attack vector to gain access, not the direct cause of the certificate compromise itself.

1. National Institute of Standards and Technology (NIST). (2020). IoT Device Cybersecurity Capability Core Baseline (NISTIR 8259A).

Reference: Section 3.2.3

"Data Protection

" Capability: "The device can protect the data it stores from unauthorized access and modification." The discussion notes emphasize protecting sensitive data stored on the device

such as keys and credentials. Storing a private key in unsecure flash violates this core capability.

2. OWASP Foundation. (2018). OWASP Internet of Things Top 10 - 2018.

Reference: Section "I5 - Insecure Data Storage." This document explicitly lists "private keys" as sensitive information that is often stored insecurely on IoT devices or in their mobile applications. The document states that a lack of encryption or access control for this data is a primary cause of compromise.

3. Purdue University. (n.d.). ECE 565: Computer and Network Security - Lecture 15: Embedded Systems Security.

Reference: Course lecture slides on Embedded Systems Security. The material discusses threats to embedded systems

including the extraction of cryptographic keys from non-volatile memory (flash). It highlights that if keys are not protected by a hardware security module (HSM) or secure element

they are vulnerable to physical and software-based extraction attacks.

The administrator's concern is with attacks that compromise confidentiality, meaning the unauthorized disclosure of sensitive information.

Aggregation is the technique of combining multiple pieces of non-sensitive data to infer sensitive information. For example, combining IoT sensor data on energy usage, water flow, and motion detection could reveal when occupants are home, which is confidential.

Inference is the process of deriving sensitive information from available data through analysis. An attacker could infer a user's health status by analyzing data from a smart appliance and a wearable fitness tracker.

Both attacks directly result in learning sensitive information that was not explicitly provided, thus violating confidentiality.

A. Salami: This is a financial fraud attack involving the theft of small amounts of money from many sources, targeting assets rather than data confidentiality.

C. Data diddling: This attack involves the unauthorized alteration of data, which is a violation of data integrity, not confidentiality.

D. Denial of Service (DoS): This attack aims to make a system or service unavailable to legitimate users, thus violating availability, not confidentiality.

1. Sicari

S.

Rizzardi

A.

Grieco

L. A.

& Coen-Porisini

A. (2015). Security

privacy and trust in Internet of Things: The road ahead. Computer Networks

76

146-164. In Section 3.2

"Privacy

" the paper discusses how data mining techniques can lead to inference and aggregation attacks in IoT

where "sensitive data about users can be inferred by aggregating information collected from different sources

" directly addressing confidentiality breaches. (DOI: https://doi.org/10.1016/j.comnet.2014.11.008)

2. National Institute of Standards and Technology (NIST). (2020). NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline. Section 2

"How to Use This Document

" defines the security objective of Confidentiality as "Preserving authorized restrictions on information access and disclosure." Aggregation and Inference are methods that bypass these restrictions.

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 1

"Introduction

" defines the core security goals. It classifies Denial of Service (DoS) as an attack on availability (p. 8) and unauthorized data modification

such as Data Diddling

as an attack on integrity (p. 7).

4. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278-1308. This foundational paper defines Confidentiality (controlling who gets to read information)

Integrity (controlling unauthorized modification of information)

and Availability (ensuring access for authorized parties). DoS and Data Diddling are classic violations of Availability and Integrity

respectively. (DOI: 10.1109/PROC.1975.9939)

IoT products in the healthcare sector frequently collect, process, and transmit sensitive Protected Health Information (PHI). This data is subject to stringent legal and ethical standards, most notably the Health Insurance Portability and Accountability Act (HIPAA) in the United States. A developer's primary responsibility is to engineer the product with robust security and privacy controls from the outset. Applying best practices for privacy protection, such as data encryption, access control, and secure data handling, is a critical and non-negotiable requirement to prevent data breaches, ensure patient confidentiality, and maintain regulatory compliance.

A. A polished user interface is a general product design goal for marketability and is not a special care item specific to healthcare regulations.

C. Rapidly completing a product without due diligence is contrary to the careful, security-focused development required for healthcare applications.

D. While FDA approval is necessary for certain medical devices, not all healthcare IoT products require it, and the goal is a compliant process, not simply a slow one.

1. U.S. Department of Health & Human Services (HHS). The HIPAA Security Rule. The Security Rule requires covered entities to implement administrative

physical

and technical safeguards to ensure the confidentiality

integrity

and security of electronic protected health information (ePHI). This directly applies to data handled by healthcare IoT devices. (Reference: 45 C.F.R. Part 160 and Subparts A and C of Part 164).

2. National Institute of Standards and Technology (NIST). NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. Section 3.2

"Privacy Risks

" discusses how IoT devices can create privacy risks by observing individuals' private spaces and collecting sensitive personal information

a concern that is paramount in the healthcare context.

3. Alsubaei

F.

Abuhussein

A.

& Shiva

S. (2017). IoT in Healthcare: A Review of Security and Privacy Challenges

and Solutions. In 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud) (pp. 298-302). This academic paper highlights that "protecting the privacy and security of patients’ data is a major concern" in healthcare IoT systems due to the sensitivity of the data collected. (DOI: 10.1109/CSCloud.2017.61)

4. MIT OpenCourseWare. HST.936: Medical Artificial Intelligence. Course materials emphasize the ethical and regulatory frameworks surrounding health data

including the importance of privacy and security in the design of new healthcare technologies

which is a core principle for developing healthcare IoT products. (Reference: MIT OCW

HST.936

Fall 2022

Lecture 18: Ethics

Privacy

and Regulation).

Internet Protocol Security (IPSec) with Authentication Headers (AH) is the most appropriate method for detecting packet injection attacks. The AH protocol provides connectionless integrity and data origin authentication for IP datagrams. It calculates an Integrity Check Value (ICV) over the packet, which allows the receiving device to verify that the packet originated from the trusted source and has not been tampered with or maliciously injected in transit. This directly addresses the administrator's requirement to detect such attacks.

A. IPSec with ESP primarily provides confidentiality through encryption. While it can offer authentication, AH is the protocol specifically designed for integrity and authentication without encryption, making it the most direct answer for detecting packet modification/injection.

B. Point-to-Point Tunneling Protocol (PPTP) is an obsolete and insecure protocol with significant known vulnerabilities and should not be used in modern networks.

C. Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol that does not provide any inherent security. It relies on another protocol, typically IPSec, to secure the data it transports.

1. Internet Engineering Task Force (IETF) RFC 4302

"IP Authentication Header":

Section 1 (Introduction): "The IP Authentication Header (AH) is used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays... Integrity is provided by the use of a Message Authentication Code (MAC)

e.g.

HMAC-SHA-1. Data origin authentication is provided by the same mechanism." This directly supports AH's role in verifying packet integrity and origin

which is essential for detecting injection.

2. Internet Engineering Task Force (IETF) RFC 4301

"Security Architecture for the Internet Protocol":

Section 4.1 (Security Services): "AH provides data origin authentication and connectionless integrity for IP datagrams (hereafter referred to as 'authentication')." This document

which defines the overall IPSec architecture

clearly designates AH as the protocol for authentication and integrity services.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson.

Chapter 20

Section 20.1 "IPsec Services": This academic textbook

widely used in university curricula

explains that "The Authentication Header (AH) provides support for data integrity and authentication of IP packets... The authentication service confirms that the message was not modified during transmission." This confirms AH's primary function aligns with the question's requirement.

A rainbow table is a precomputed table used for reversing cryptographic hash functions to crack passwords. This attack is effective against password databases that have been compromised, particularly when passwords are not "salted." The most direct countermeasure is to use a salt (a unique random value added to each password before hashing).

Since salting is not an option, implementing robust password policies is the best available mitigation. Enforcing policies that require long and complex passwords exponentially increases the size of the password space. This makes the precomputation of hashes for a rainbow table prohibitively large and computationally expensive, rendering the attack impractical and effectively mitigating the risk.

B. Implement certificates on all login pages: Certificates (TLS/SSL) encrypt data in transit, protecting against eavesdropping, but they do not protect the stored password hashes on the server from an offline rainbow table attack.

C. Implement granular role-based access: Role-Based Access Control (RBAC) is an authorization mechanism that restricts user actions after successful authentication. It does not prevent the initial account compromise via password cracking.

D. Implement URL filtering: URL filtering is a network security control used to block access to malicious or unauthorized websites. It is entirely unrelated to protecting a system's password database.

---

1. National Institute of Standards and Technology (NIST)

Special Publication 800-63B

Digital Identity Guidelines: Section 5.1.1

"Memorized Secrets

" discusses password security. While it mandates salting as the primary defense against pre-computation attacks (like rainbow tables)

it also emphasizes password length. A longer password dramatically increases the search space

making pre-computation for attacks like rainbow tables infeasible. The document states

"verifiers SHALL require memorized secrets to be at least 8 characters in length... Allowing longer memorized secrets

such as passphrases

is encouraged." This directly supports that a stronger policy (length) is a key mitigation factor.

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education. In Chapter 5

"Passwords

" the text explains password vulnerabilities. It details how the size of the password space (determined by length and character set

i.e.

the password policy) is a critical factor in resisting brute-force and pre-computation attacks. A larger space makes creating comprehensive rainbow tables impractical.

3. Stanford University

CS 155: Computer and Network Security

Lecture 5: Web Security Model. Course materials explain that while salting is the direct defense against rainbow tables

password strength is a fundamental control. The lecture notes clarify that the effectiveness of any password cracking attack

including those using rainbow tables

is inversely proportional to the size of the password space

which is governed by password policies.

Storing passwords as a hash value is a fundamental security best practice. Hashing is a one-way cryptographic function that converts a password into a fixed-length, non-reversible string of characters called a hash. When a user attempts to log in, the system hashes the entered password and compares it to the stored hash. This ensures that the actual password is never stored in a recoverable format, protecting user credentials even if the authentication database is compromised. Modern systems enhance this by adding a unique "salt" to each password before hashing to prevent pre-computation attacks like rainbow tables.

A. This describes a password expiration policy, a management practice, not the technical method for secure storage.

B. Storing passwords in cleartext is a critical security vulnerability that exposes them directly in case of a data breach.

D. Digital certificates are used in Public Key Infrastructure (PKI) to bind a public key to an identity, not for storing user passwords.

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines

Authentication and Lifecycle Management. Section 5.1.1.2

"Memorized Secret Verifiers

" states: "Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function." (Page 19). Available: https://doi.org/10.6028/NIST.SP.800-63b

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. Section I.B.3

"Password Protection

" describes the foundational concept: "The password file

instead of containing a list of passwords

can contain a list of results of a one-way encryption function applied to the passwords." (Page 1285). Available: https://doi.org/10.1109/PROC.1975.9939

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Lecture 4: Web Security. The lecture notes explicitly state the secure method for password storage: "Store hash(password) instead of password." (Slide 29). Available: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/mit6858f14lec4/

The principle of least privilege is a foundational security concept that dictates a user or entity should only be granted the minimum permissions necessary to accomplish their required tasks. This is the very essence of implementing granular access control. By restricting access to only what is essential, the potential attack surface is minimized, and the risk of intentional or unintentional abuse of access rights is significantly reduced. This principle ensures that if an account is compromised, the damage is contained to the minimal set of permissions assigned to that account.

A. System administrator access: This represents the highest level of privilege, the opposite of a granular or least privilege approach, and carries the greatest risk of abuse.

C. Guest account access: This is a specific, highly restricted user type, not a general principle for implementing granular control across an organization to minimize risk.

D. Discretionary access control (DAC): This is a type of access control model, not the implementation principle itself. DAC can be configured to enforce least privilege, but the principle is the guiding rule.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Revision 5). U.S. Department of Commerce. See control AC-6 Least Privilege

Section 2.1

which states

"The principle of least privilege is applied to the privileges assigned to individuals and to the processes acting on behalf of individuals."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. https://doi.org/10.1109/PROC.1975.9939. See Section I.A.4

"Principle of Least Privilege

" which defines it as a fundamental design principle for secure systems.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology. See Lecture 2: "Control Hijacking

" Section on "Security Principles

" which identifies "Least Privilege" as a core strategy to limit the capabilities of an attacker.

Encryption is the process of converting plaintext data into an unreadable format called ciphertext. This is achieved using a cryptographic algorithm and a key. Only authorized individuals who possess the correct decryption key can revert the ciphertext back to its original, readable form. By rendering the data unintelligible to unauthorized parties, encryption directly enforces confidentiality for data at rest, such as information stored within a database. If an attacker gains access to the physical database files, the encrypted data remains protected and confidential without the corresponding key.

A. Hashing: Hashing is a one-way function primarily used for data integrity verification and secure password storage, not for general data confidentiality as it is not reversible.

B. Archiving: Archiving is a data lifecycle management process for long-term storage and retention. It does not inherently provide confidentiality for the data being stored.

C. Monitoring: Monitoring is a detective control used to observe and log access to a database. It helps identify unauthorized activity but does not prevent the initial breach of confidentiality.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-57 Part 1 Revision 5: Recommendation for Key Management: Part 1 – General. Section 2.2.1

"Cryptographic Mechanisms and Services

" p. 10. This document states

"Encryption provides the service of confidentiality."

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education. Chapter 1

"Introduction

" Section 1.2

"The Meaning of Computer Security

" p. 6. The text explicitly defines confidentiality as "ensuring that data is not disclosed to unintended persons" and identifies encryption as a primary mechanism to achieve it.

3. University of California

Berkeley. (n.d.). Security of Information Systems and Networks - CS 161. Course materials. Lecture notes on "Cryptography" typically define encryption as the fundamental tool for ensuring the confidentiality of data both in transit and at rest.

The core issue is one of authorization, where end users have permissions exceeding their required access levels. Implementing granular role-based access control (RBAC) directly addresses this by assigning permissions based on defined roles (e.g., 'administrator', 'end user') rather than to individual users. This allows the administrator to create a specific 'end user' role with restricted privileges, preventing access to administrative features. This method enforces the principle of least privilege, ensuring users only have the access necessary to perform their intended functions, thus resolving the identified security vulnerability.

A. Implement password complexity policies: This enhances authentication security by making passwords harder to guess but does not control a user's permissions after they have logged in.

C. Implement account lockout policies: This is a defensive measure against brute-force authentication attacks and does not affect the permissions granted to an already authenticated user.

D. Implement digitally signed firmware updates: This secures the IoT devices themselves by ensuring firmware integrity, but it is unrelated to user access control on a management portal.

1. CertNexus. (2020). Exam ITS-110: CertNexus Certified Internet of Things (IoT) Security Practitioner.

Domain 4.0: Securing IoT

Objective 4.3: "Given a scenario

implement access control measures." This objective explicitly lists "Role-based" access control as a key skill

directly aligning with the solution to the scenario where different user types (end users vs. administrators) require different permissions.

2. National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 800-53

Revision 5: Security and Privacy Controls for Information Systems and Organizations.

Section: AC-2 Account Management & AC-3 Access Enforcement. These controls detail the necessity of enforcing assigned authorizations. The publication states

"The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies." RBAC is a primary method for implementing these controls.

3. Hu

V. C.

Ferraiolo

D.

Kuhn

R.

Schnitzer

A.

Sandlin

K.

Miller

R.

& Scarfone

K. (2017). NIST Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations.

Section 2.2

Role Based Access Control (RBAC). This document

while focused on ABAC

provides a clear definition of RBAC: "In the RBAC model

permissions are associated with roles

and users are assigned to appropriate roles." This directly explains the mechanism needed to solve the problem of users having inappropriate administrative access.