hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which THREE of the following are common…
Which THREE of the following are common vulnerabilities in IoT devices? (Select THREE.)
⚠ Common exam trap
CompTIA often tests the misconception that hardware features like storage or compute power are vulnerabilities, when in fact the risks stem from insecure design choices (e.g., hardcoded credentials, lack of encryption) rather than raw capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hardcoded credentials
Hardcoded credentials (Option B) are a common IoT vulnerability because manufacturers often embed default usernames and passwords (e.g., 'admin/admin') into device firmware for ease of deployment. Attackers can exploit these static credentials via SSH, Telnet, or web interfaces to gain unauthorized access, as seen in Mirai botnet attacks. This violates the principle of least privilege and secure credential management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Large storage capacity
Why it's wrong here
IoT devices generally have limited storage, not large.
- ✓
Hardcoded credentials
Why this is correct
Many IoT devices ship with default or hardcoded credentials that cannot be changed.
- ✓
Lack of secure boot
Why this is correct
Without secure boot, attackers can load malicious firmware.
- ✗
High compute power
Why it's wrong here
IoT devices typically have low compute power.
- ✓
Unencrypted communications
Why this is correct
Many IoT devices transmit data without encryption, making it susceptible to interception.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.