CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Default credentials

  Why this is correct

  Many IoT devices are deployed with factory-set usernames and passwords that are publicly known or easily guessable. Attackers leverage extensive databases of these default credentials to gain unauthorized access to devices, often en masse. This vulnerability allows for full device compromise, enabling actions like data exfiltration, device manipulation, or recruitment into botnets without requiring complex exploits.

• ✗

  Firmware extraction via JTAG

  Why it's wrong here

  Firmware extraction via JTAG is primarily a reverse engineering or forensic analysis technique, not a common initial attack vector for remote compromise. JTAG (Joint Test Access Port) interfaces require physical access to the device's circuit board and are typically used for debugging, boundary scanning, or flashing firmware during development. While it can reveal vulnerabilities for future attacks, it does not represent a widespread, scalable method for initial unauthorized access against deployed IoT devices.

• ✓

  Insecure protocols like MQTT without encryption

  Why this is correct

  Protocols such as MQTT, when implemented without proper encryption (e.g., TLS/SSL), transmit sensitive data and control commands in plaintext over the network. This lack of confidentiality allows attackers to easily eavesdrop on communications, intercepting device telemetry, user data, or critical operational instructions. Furthermore, the absence of integrity protection enables command injection, where malicious actors can alter messages or inject unauthorized commands to manipulate device behavior, leading to data corruption or system compromise.

• ✗

  Replay attacks on encrypted sessions

  Why it's wrong here

  Replay attacks involve an attacker capturing legitimate, encrypted communication packets and re-transmitting them later to trick a system into performing an action. While theoretically possible, well-designed encrypted protocols and session management mechanisms in IoT devices typically incorporate countermeasures like nonces, timestamps, or sequence numbers to detect and reject replayed messages. Therefore, against properly implemented secure protocols, replay attacks are not a primary or common initial attack vector, as they are often mitigated by robust session handling.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a web application vulnerability that exploits improper input validation to inject malicious SQL queries into a backend database, typically through web forms or API endpoints. Most IoT devices, however, do not expose web-facing SQL databases as their primary interface for data storage or control. Instead, they often rely on simpler embedded databases, direct sensor communication, or specialized IoT protocols, making SQL injection largely irrelevant as a direct attack vector against the device itself.

Go deeper

Related to this question