ITS-110 Certified Internet of Things Security Practitioner Practice Questions

This option is the most comprehensive. MQTTS with mTLS addresses data protection and provides a strong, unique identity. Storing the certificate's private key in a TPM protects it from physical extraction (Requirement 4). A signed OTA update process ensures secure updates (Requirement 3). Secure Boot leverages the TPM to ensure firmware integrity at boot time, further enhancing physical security. This solution effectively covers all four requirements with industry best practices.

In a centralized Zigbee security model, the Trust Center is the dedicated device responsible for configuring and distributing security keys (like the Network Key) and managing device admissions. The role of the Trust Center is typically performed by the Zigbee Coordinator.

Security best practices dictate that all credentials, including API keys and access tokens, should have a limited lifetime and be rotated regularly. This minimizes the window of opportunity for an attacker to use a compromised key. Keys without an expiration date pose a significant long-term risk.

In a digital signature scheme, the sender (manufacturer) signs the data using their secret private key. The receiver (IoT device) then uses the sender's corresponding public key, which can be widely distributed, to verify that the signature is valid and that the data has not been tampered with.

Network segmentation is the practice of dividing a network into smaller, isolated segments. In this scenario, the infusion pumps should be placed on a dedicated, isolated VLAN or network segment that is firewalled off from both the guest network and the main corporate network. This prevents lateral movement of threats and contains potential breaches. While the other options are good security practices, segmentation provides the direct protection required by the scenario.

Protocol for Carrying Authentication for Network Access (PANA) is a network-layer protocol specifically designed for network access authentication in IP-based networks, making it suitable for 6LoWPAN. It works with the Extensible Authentication Protocol (EAP) to provide robust authentication before a device is granted full network access. IPsec is too heavyweight for many constrained 6LoWPAN devices. MAC filtering is easily spoofed and not scalable. DTLS operates at the transport layer, not the network layer for initial access control.

For handling sensitive Protected Health Information (PHI) under HIPAA, the highest level of security is required. BLE Security Mode 1, Level 4 mandates the use of LE Secure Connections, which uses Elliptic Curve Diffie-Hellman (ECDH) key exchange for strong encryption and protects against passive eavesdropping and man-in-the-middle attacks. The lower security levels (1, 2, and 3) are not sufficient for protecting sensitive medical data.

Digital signatures provide authenticity (proving the firmware came from the manufacturer) and integrity (ensuring it wasn't altered).

Secure boot ensures that the PLC will only load and execute firmware that has been cryptographically verified (e.g., by checking the digital signature), thus preventing unauthorized code from running.

Constrained Application Protocol (CoAP) is designed for constrained devices and networks, running over UDP. Datagram Transport Layer Security (DTLS) provides security equivalent to TLS but is adapted for datagram-based protocols like UDP, making it ideal for low-power, lossy networks. This combination is energy-efficient and provides strong security. TLS over TCP, IPsec, and SSH are all too resource-intensive for this use case.

The statement is false. Privacy by Design is a core principle that dictates privacy should be embedded into the design and architecture of IT systems and business practices from the very beginning of the development lifecycle, not added as an afterthought. It emphasizes proactive rather than reactive measures.