CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
An IoT device uses the MQTT protocol without TLS. An attacker on the same network captures messages and publishes a fake temperature reading. Which attack is being executed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle attack
MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replay attack
Why it's wrong here
A replay attack involves an adversary passively capturing legitimate data transmissions and then retransmitting them later to achieve an unauthorized effect, such as re-executing a command. While MQTT messages without TLS are vulnerable to capture, the scenario describes an attacker actively publishing a new fake message, which is distinct from merely replaying a previously observed, valid message. This implies message crafting and injection rather than simple retransmission of existing data.
- ✗
Firmware reversing attack
Why it's wrong here
Firmware reversing is a static analysis technique where an attacker extracts and disassembles or decompiles the embedded software from a device to understand its functionality, identify vulnerabilities, or extract sensitive information. This method operates offline on the device's software image and does not involve real-time network interaction or the injection of messages into a live communication stream. Therefore, it is irrelevant to the described network-level attack involving MQTT protocol manipulation.
- ✓
Man-in-the-middle attack
Why this is correct
A Man-in-the-Middle (MITM) attack is precisely what occurs when an attacker intercepts communications between two parties, in this case, an MQTT client and broker, without either party being aware. Since MQTT is used without TLS, the communication channel is unencrypted, allowing the attacker to easily intercept, read, modify, or inject arbitrary fake messages into the cleartext data stream. This direct manipulation of active network traffic, including the injection of new, crafted messages, is the hallmark of a successful MITM attack.
- ✗
Denial of service attack
Why it's wrong here
A Denial of Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the internet. This typically involves overwhelming the target with excessive traffic, exploiting software vulnerabilities to crash services, or consuming all available resources. The scenario describes injecting a fake message to achieve a specific malicious outcome, which is distinct from merely preventing service availability through resource exhaustion or system crashes.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.