CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst observes that a server running an IoT device management platform is sending MQTT traffic to an unexpected IP address. The analyst also notes that the device's firmware contains hardcoded credentials. Which attack vector is MOST likely being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure MQTT protocol exploitation via default credentials
The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CoAP protocol attack
Why it's wrong here
CoAP (Constrained Application Protocol) is a specialized web transfer protocol for constrained devices and networks, often used in IoT as an alternative to HTTP. However, the scenario explicitly mentions or strongly implies the use of MQTT, which is a distinct messaging protocol. Without any specific indicators or context within the question stem pointing towards CoAP, attributing the observed security incident to a CoAP protocol attack would be an unsubstantiated conclusion.
- ✓
Insecure MQTT protocol exploitation via default credentials
Why this is correct
Insecure MQTT (Message Queuing Telemetry Transport) protocol exploitation via default credentials is a common and critical vulnerability in IoT deployments. Many MQTT brokers are configured with weak or absent authentication, or rely on easily guessable default usernames and passwords. An attacker exploiting these weaknesses can subscribe to all topics, publish malicious commands, exfiltrate sensitive data, and gain unauthorized control over connected IoT devices, directly aligning with active exploitation behavior.
- ✗
Firmware reversing attack
Why it's wrong here
Firmware reversing is a forensic and analytical technique used to deconstruct and analyze the embedded software of a device, often to discover vulnerabilities, extract hardcoded credentials, or understand its operational logic. While it can be a crucial preparatory step for an attacker to find credentials, the observed behavior described in the scenario indicates active exploitation of a protocol. Firmware reversing itself is a method of analysis, not the direct attack vector or the observed malicious activity.
- ✗
Container escape attack
Why it's wrong here
A container escape attack involves a malicious actor breaking out of an isolated container environment to gain unauthorized access to the underlying host operating system or other containers. While IoT device management platforms might utilize containerization for deployment, this type of attack specifically targets the container runtime and its isolation mechanisms. The observed activity, however, focuses on the exploitation of an IoT communication protocol (MQTT), not the compromise of a containerized environment's integrity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?
medium- A.Weaponization
- B.Installation
- ✓ C.Reconnaissance
- D.Exploitation
Why C: Finding hardcoded credentials in firmware is an act of information gathering about the target device and its backend. This corresponds to the Reconnaissance phase of the IoT attack lifecycle, where attackers collect data to identify vulnerabilities. The exploitation phase would involve using the credentials to gain access, not just discovering them.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.