CPENT IoT and OT Penetration Testing

1. What is default credential exploitation in IoT systems?

Using manufacturer-provided usernames and passwords to gain unauthorized access

Creating new user accounts on devices

Resetting device passwords

Generating random credentials

2. Which regulatory framework specifically addresses IoT and OT security requirements?

NIST Cybersecurity Framework and IEC 62443

HIPAA only

PCI-DSS exclusively

GDPR alone

3. What is the importance of baseline documentation in OT penetration testing?

Establishing normal system behavior to detect anomalies and unauthorized changes

Determining the age of equipment

Calculating operational costs

Planning device replacement schedules

4. Which attack involves sending malformed packets to crash IoT devices?

Fuzzing

Brute forcing

SQL injection

Cross-site scripting

5. In OT security, what does 'air-gapped' mean?

A system physically isolated from external networks

A wireless network without encryption

A device with limited battery power

A system using outdated protocols

6. What is the purpose of a Shodan search in IoT reconnaissance?

Finding exposed IoT devices and services publicly accessible on the internet

Scanning local network devices only

Encrypting device communications

Patching device vulnerabilities

7. Which IoT vulnerability allows attackers to modify device behavior without authentication?

Insecure direct object references and weak access controls

Excessive encryption

Strong password policies

Multi-factor authentication

8. What is the primary goal of a supply chain attack on IoT devices?

Compromising devices during manufacturing to insert malware before delivery

Stealing customer payment information

Increasing device prices

Improving device performance

9. In OT environments, what is a Programmable Logic Controller (PLC)?

An industrial computer controlling machinery and production processes

A personal laptop computer

A cloud storage device

A mobile phone application

10. Which communication protocol is most susceptible to eavesdropping?

Unencrypted HTTP and plain-text protocols

TLS 1.3

AES-256 encrypted channels

VPN tunnels

11. What is the primary difference between IoT and OT environments?

IoT focuses on consumer devices; OT controls industrial processes

IoT requires higher bandwidth than OT

OT systems use only proprietary protocols

IoT devices cannot be networked together

12. Which tool is commonly used for MQTT protocol testing?

MQTT.fx and Mosquitto

Wireshark only

Burp Suite exclusively

Nessus alone

13. In IoT security, what does the term 'edge computing' refer to?

Processing data closer to the source rather than in centralized cloud

Data stored at network boundaries only

Devices located at the perimeter of buildings

Cloud computing exclusively

14. What is the CVSS score range for severity classification?

0.0 to 10.0

1 to 100

0 to 5

-1 to 1

15. Which of the following is a primary challenge in OT penetration testing?

Safety-critical systems cannot tolerate downtime or disruption

OT systems are always air-gapped

All OT protocols are encrypted by default

OT devices update automatically

16. What is a firmware extraction attack in IoT testing?

Obtaining device firmware to analyze for hardcoded credentials and vulnerabilities

Removing all software from a device

Updating firmware to the latest version

Encrypting firmware files

17. In OT penetration testing, why is network segmentation critical?

To isolate control systems from corporate networks and limit breach impact

To increase network speed

To reduce the number of routers needed

To eliminate the need for firewalls

18. Which protocol is most commonly used for IoT device communication?

MQTT, CoAP, and Zigbee

HTTP and HTTPS only

Ethernet exclusively

Bluetooth Low Energy for all devices

19. What vulnerability class is commonly found in legacy OT systems?

Lack of authentication and encryption

Excessive API rate limiting

Overly complex firewall rules

Automatic security patching

20. Which reconnaissance technique is most effective for discovering IoT devices on a network?

NMAP with service version detection

Social engineering only

Physical inspection of hardware

Reviewing DNS records exclusively

CPENT IoT and OT Penetration Testing Quiz