CEH Wireless, IoT and Cloud Security Practice Questions

Explanation: A Wireless Intrusion Prevention System (WIPS) continuously monitors the radio frequency spectrum to detect, locate, and block rogue access points. It can automatically classify devices based on their behavior and signatures, and when a rogue AP is identified, the WIPS can launch a de-authentication attack against the rogue device or its clients, effectively neutralizing the threat. This makes WIPS a direct and proactive countermeasure against rogue APs. 802.1X authentication, when implemented on wired switch ports, acts as a crucial countermeasure. It ensures that only authenticated devices (e.g., legitimate corporate computers or authorized access points) can gain access to the corporate wired network. If an unauthorized device, such as a rogue access point, is plugged into a port protected by 802.1X, it will be denied network access, effectively preventing it from becoming a functional rogue AP connected to the internal network.

Explanation: Misconfigured cloud storage, such as overly permissive access controls on data buckets, is a leading cause of data breaches. Shared technology vulnerabilities, inherent in multi-tenant cloud environments, can allow an attacker to impact multiple customers if the underlying infrastructure (e.g., hypervisor, shared libraries) is compromised. Insecure application programming interfaces (APIs) provide a critical attack surface, as cloud services are heavily managed and accessed via APIs, making their security paramount. These three risks are consistently identified by organizations like the Cloud Security Alliance (CSA) and NIST as among the most prevalent cloud security threats.

Explanation: BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

Explanation: The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.

Explanation: BYOD devices are personally owned and not under direct corporate management, leading to a lack of visibility into their security posture. Without a Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solution, the organization cannot assess patch levels, antivirus status, or jailbreak/root status, leaving the network exposed to compromised devices. Additionally, the presence of personal applications on BYOD devices creates a significant risk of data leakage. Users might inadvertently or maliciously transfer sensitive corporate data from managed corporate applications to unmanaged personal applications (e.g., copying text from a corporate email to a personal messaging app or cloud storage service), bypassing corporate data loss prevention (DLP) controls.