CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Loss of message confidentiality
Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firmware corruption
Why it's wrong here
MQTT without TLS primarily exposes message content and allows for message injection or modification. Firmware corruption, however, typically requires exploiting vulnerabilities in the device's update mechanism, gaining privileged access to the device's operating system, or sending specifically crafted, often non-MQTT, commands that trigger a critical system flaw. While an attacker might eventually leverage intercepted information to craft such an attack, the direct consequence of unencrypted MQTT traffic is not firmware corruption itself.
- ✗
Denial of service
Why it's wrong here
While an attacker can potentially launch a Denial of Service (DoS) attack against an MQTT broker or connected devices, simply subscribing to an unsecured topic due to the absence of TLS does not directly constitute a DoS. Subscribing allows an attacker to receive messages, leading to confidentiality loss. A DoS attack would typically involve actively flooding the broker with excessive messages, rapidly connecting/disconnecting clients, or exploiting specific broker vulnerabilities, which are subsequent actions beyond mere interception.
- ✗
Replay attacks
Why it's wrong here
Replay attacks are indeed possible when MQTT traffic is unencrypted, as an attacker can capture legitimate messages and retransmit them later to trick devices or the broker into executing old commands or accepting stale data. However, before an attacker can effectively perform a replay attack, they must first intercept and understand the content of the messages. Therefore, the immediate and foundational impact of MQTT without TLS is the loss of message confidentiality, which then enables subsequent attacks like replay.
- ✓
Loss of message confidentiality
Why this is correct
The absence of Transport Layer Security (TLS) means that all MQTT communication, including connection requests, published messages, and subscription acknowledgments, is transmitted in cleartext over the network. Any attacker with network access can easily intercept and read these unencrypted messages using packet sniffers. This direct exposure of sensitive data, commands, or telemetry being exchanged between IoT devices and the MQTT broker constitutes an immediate and severe loss of message confidentiality.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.