CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
An IoT device uses MQTT for communication. An attacker intercepts MQTT packets and observes that the publish messages are not encrypted and contain plaintext sensor data. Which of the following is the BEST recommendation to secure MQTT traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use MQTT over TLS
MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Base64-encode the payload
Why it's wrong here
Base64 encoding transforms binary data into an ASCII string format, making it suitable for transmission over mediums that may not handle raw binary data gracefully. However, it is a reversible encoding scheme, not an encryption method. Anyone intercepting a Base64-encoded payload can easily decode it back to its original form without needing a key, thus offering no protection against eavesdropping or ensuring data confidentiality.
- ✗
Switch to CoAP protocol
Why it's wrong here
Switching to the Constrained Application Protocol (CoAP) would not inherently solve the problem of an attacker intercepting communications, as CoAP, like MQTT, is unencrypted by default. While CoAP can be secured using Datagram Transport Layer Security (DTLS) for confidentiality and integrity, merely adopting the protocol without explicitly implementing DTLS would leave the communication channel just as vulnerable to eavesdropping as plain MQTT. The security mechanism, not just the protocol, must be chosen and configured.
- ✓
Use MQTT over TLS
Why this is correct
Using MQTT over TLS (Transport Layer Security), often referred to as MQTTS, is the standard and most effective method to secure MQTT communications against eavesdropping. TLS establishes an encrypted tunnel between the MQTT client and broker, ensuring that all data exchanged is confidential and cannot be read by unauthorized parties. Furthermore, TLS provides data integrity verification, preventing tampering, and offers server authentication through certificates, confirming the identity of the broker to the client.
- ✗
Implement a VPN on the device
Why it's wrong here
Implementing a Virtual Private Network (VPN) on an IoT device, while providing an encrypted tunnel, is generally an overly complex and resource-intensive solution for securing individual application-layer protocols like MQTT. VPNs introduce significant overhead in terms of CPU, memory, and network bandwidth, which are often constrained on IoT devices. Furthermore, a VPN secures the entire network connection, whereas MQTT over TLS specifically targets and secures the MQTT application layer communication, making it a more lightweight and protocol-specific solution.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.