CERTNEXUS-ITS-110-2025 Practice Questions

In many Internet of Things (IoT) architectures, remote sensors and devices are managed as a group. To secure communications, a Virtual Private Network (VPN) using the Internet Protocol Security (IPSec) suite is often established between the management station and the remote network gateway. This creates a secure tunnel, encrypting all traffic. Within this tunnel, administrators might use lightweight, unencrypted protocols for sessions, assuming the tunnel provides confidentiality. If the IPSec tunnel is misconfigured or disabled, this layer of protection is lost, and the administrative session traffic is transmitted in cleartext over the public internet, making it vulnerable to eavesdropping.

A. Secure Shell (SSH): SSH is an encrypted protocol. If SSH were being used for the administrative session, eavesdropping would not be possible, even if a network-level tunnel was not active.

C. Telnet: While using the unencrypted Telnet protocol allows eavesdropping, in a properly designed IoT architecture, its use is often restricted to within a secure tunnel (like IPSec). The failure is the misconfiguration of the tunnel that exposes the traffic.

D. Virtual private network (VPN): This is a general term for the technology. IPSec is a specific and common protocol suite used to implement network-layer VPNs, making it a more precise and technically accurate answer.

1. National Institute of Standards and Technology (NIST)

NISTIR 8259A

IoT Device Cybersecurity Capability Core Baseline

May 2020. Section 3.2

"Device Security

" subsection "3.2.1 Data Protection

" states: "The IoT device should use a secure and trusted communication channel for all remote network connections... This may be accomplished by the device itself (e.g.

by using TLS) or by a trusted component in the device’s immediate network environment (e.g.

a network gateway that implements a VPN)." This reference supports the architectural pattern where a VPN (often using IPSec) is the primary security control. Its failure would expose underlying communications.

2. Kent

S.

& Seo

K. (2005). RFC 4301: Security Architecture for the Internet Protocol. Internet Engineering Task Force (IETF). Section 1.1

"Benefits of IPsec

" states that IPSec can provide confidentiality (encryption) for all traffic at the IP layer. A misconfiguration or disabling of this service would negate this benefit

exposing the data payloads to eavesdropping.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 20

"IP Security

" details how IPSec provides security for all traffic between two endpoints (e.g.

a gateway and a host). The text explains that IPSec's transport and tunnel modes are designed to prevent attacks like eavesdropping. The scenario in the question describes a failure of this preventative mechanism.

The administrator's concern is with attacks that compromise confidentiality, meaning the unauthorized disclosure of sensitive information.

Aggregation is the technique of combining multiple pieces of non-sensitive data to infer sensitive information. For example, combining IoT sensor data on energy usage, water flow, and motion detection could reveal when occupants are home, which is confidential.

Inference is the process of deriving sensitive information from available data through analysis. An attacker could infer a user's health status by analyzing data from a smart appliance and a wearable fitness tracker.

Both attacks directly result in learning sensitive information that was not explicitly provided, thus violating confidentiality.

A. Salami: This is a financial fraud attack involving the theft of small amounts of money from many sources, targeting assets rather than data confidentiality.

C. Data diddling: This attack involves the unauthorized alteration of data, which is a violation of data integrity, not confidentiality.

D. Denial of Service (DoS): This attack aims to make a system or service unavailable to legitimate users, thus violating availability, not confidentiality.

1. Sicari

S.

Rizzardi

A.

Grieco

L. A.

& Coen-Porisini

A. (2015). Security

privacy and trust in Internet of Things: The road ahead. Computer Networks

76

146-164. In Section 3.2

"Privacy

" the paper discusses how data mining techniques can lead to inference and aggregation attacks in IoT

where "sensitive data about users can be inferred by aggregating information collected from different sources

" directly addressing confidentiality breaches. (DOI: https://doi.org/10.1016/j.comnet.2014.11.008)

2. National Institute of Standards and Technology (NIST). (2020). NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline. Section 2

"How to Use This Document

" defines the security objective of Confidentiality as "Preserving authorized restrictions on information access and disclosure." Aggregation and Inference are methods that bypass these restrictions.

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 1

"Introduction

" defines the core security goals. It classifies Denial of Service (DoS) as an attack on availability (p. 8) and unauthorized data modification

such as Data Diddling

as an attack on integrity (p. 7).

4. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278-1308. This foundational paper defines Confidentiality (controlling who gets to read information)

Integrity (controlling unauthorized modification of information)

and Availability (ensuring access for authorized parties). DoS and Data Diddling are classic violations of Availability and Integrity

respectively. (DOI: 10.1109/PROC.1975.9939)

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU). A core tenet of GDPR is granting individuals, referred to as data subjects, specific rights over their personal data. The scenario describes European customers being unable to access their personal information, which directly relates to the "right of access by the data subject" enshrined in Article 15 of the GDPR. This right mandates that organizations must provide individuals with a copy of their personal data upon request. As the company is a multi-national vendor with European customers, it is subject to GDPR and is at risk of violating this fundamental right.

A. Sarbanes-Oxley (SOX): This is a United States federal law focused on corporate governance and financial reporting to protect investors, not a regulation concerning consumer data privacy rights.

C. Electronic Identification Authentication and Trust Services (eIDAS): This EU regulation standardizes electronic identification and trust services (like electronic signatures) across member states but does not govern the general right of individuals to access their personal data.

D. Database Service on Alternative Methods (DB-ALM): This is not a recognized data protection regulation. It appears to be a distractor term with no standing in the context of international data privacy law.

1. Official Journal of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). EUR-Lex. Article 15

"Right of access by the data subject

" Paragraph 1

states

"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed

and

where that is the case

access to the personal data..."

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679

2. European Commission. (n.d.). eIDAS Regulation. Shaping Europe’s digital future. The official EU page describes eIDAS as a regulation to "provide a predictable regulatory environment to enable secure and seamless electronic interactions between businesses

citizens and public authorities." It does not cover the data access rights described in the question.

Source: https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation

3. U.S. Securities and Exchange Commission. (2022). The Laws That Govern the Securities Industry: Sarbanes-Oxley Act of 2002. This official source describes SOX as a law that "mandated a number of reforms to enhance corporate responsibility

enhance financial disclosures and combat corporate and accounting fraud."

Source: https://www.sec.gov/answers/sox302.htm

4. Kamara

I. & de Hert

P. (2018). Understanding the Right of Access of the GDPR. In: Enforcing Privacy. Law

Governance and Technology Series

vol 37. Springer

Cham. This academic publication analyzes the GDPR's right of access

stating

"The right of access is a cornerstone of data protection. It is the right that allows data subjects to find out what data controllers know about them..." (p. 135).

DOI: https://doi.org/10.1007/978-3-319-70327-26

A backdoor is a covert method of bypassing normal authentication or security mechanisms to gain access to a system. Software developers may legitimately implement a backdoor during the development phase to facilitate easier testing, debugging, or administrative access. Conversely, attackers install backdoors on compromised systems to create a persistent, hidden entry point. This allows them to maintain remote control and access the system in the future, even if the original vulnerability that granted them initial entry is discovered and patched. This dual-use nature, serving both legitimate maintenance and malicious control, makes it the correct answer.

A. Disassembler: A disassembler is a reverse-engineering tool used to analyze compiled code. It is not a mechanism for maintaining persistent control over a system.

C. Debugger: A debugger is a tool used by both developers and attackers to analyze running programs and find flaws, not to maintain long-term, persistent access.

D. Stack pointer: A stack pointer is a fundamental CPU register used in program execution. It is not a tool or technique implemented for maintenance or control.

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 6.2

"Types of Malicious Software (Malware)

" a backdoor (or trap door) is described as a "secret entry point into a program" that can be used by programmers for testing but is also a common component of malware installed by an intruder.

2. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. Chapter 9

"Security and Protection

" Section 9.6.3

"Subtle Security Attacks

" discusses trap doors (backdoors) as security flaws that can be intentionally planted by a developer for debugging or by an attacker for later exploitation.

3. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Back Door. Computer Security Resource Center. The official definition is "An undocumented way of gaining access to a computer system. A back door is a potential security risk." This definition encompasses both intentional developer-created access points and malicious ones.

The issue described is unauthorized users logging onto remote IoT devices. This is a classic indicator of compromised or weak authentication credentials. The most common vulnerability of this type in IoT ecosystems is the use of factory-default usernames and passwords, which are often publicly documented and rarely changed by administrators. Changing the default passwords on all devices is the most direct and immediate action to revoke access for unauthorized users who are exploiting these known credentials, thereby resolving the primary security flaw.

A. Encrypting data protects it from being read if stolen (data at rest), but it does not prevent the unauthorized login itself.

B. While applying firmware updates is a critical security practice, it does not directly address an authentication issue based on weak or default passwords.

D. URL filtering is a network-level control that restricts access to websites; it does not secure the device's own login and authentication mechanism.

1. National Institute of Standards and Technology (NIST). (2021). IoT Device Cybersecurity Guidance for the Federal Government: Foundational Activities and Core Device Cybersecurity Capability Baseline. NIST Special Publication 800-213A. Section 3.2

"Device Security

" identifies as a core capability that IoT devices should have "no default passwords" and support changing passwords. This directly supports changing default credentials to prevent unauthorized access. (Available at: https://doi.org/10.6028/NIST.SP.800-213A)

2. European Union Agency for Cybersecurity (ENISA). (2020). Baseline Security Recommendations for IoT. Section 4.2.1

"No Universal Default Passwords

" explicitly states that devices should not have default passwords and force users to change them upon first use to prevent trivial takeovers.

3. OWASP Foundation. (2018). OWASP Internet of Things Top 10 - 2018. The number one vulnerability listed is "I1 - Weak

Guessable

or Hardcoded Passwords." The remediation guidance emphasizes enforcing strong password policies and ensuring default credentials are changed.

IoT products in the healthcare sector frequently collect, process, and transmit sensitive Protected Health Information (PHI). This data is subject to stringent legal and ethical standards, most notably the Health Insurance Portability and Accountability Act (HIPAA) in the United States. A developer's primary responsibility is to engineer the product with robust security and privacy controls from the outset. Applying best practices for privacy protection, such as data encryption, access control, and secure data handling, is a critical and non-negotiable requirement to prevent data breaches, ensure patient confidentiality, and maintain regulatory compliance.

A. A polished user interface is a general product design goal for marketability and is not a special care item specific to healthcare regulations.

C. Rapidly completing a product without due diligence is contrary to the careful, security-focused development required for healthcare applications.

D. While FDA approval is necessary for certain medical devices, not all healthcare IoT products require it, and the goal is a compliant process, not simply a slow one.

1. U.S. Department of Health & Human Services (HHS). The HIPAA Security Rule. The Security Rule requires covered entities to implement administrative

physical

and technical safeguards to ensure the confidentiality

integrity

and security of electronic protected health information (ePHI). This directly applies to data handled by healthcare IoT devices. (Reference: 45 C.F.R. Part 160 and Subparts A and C of Part 164).

2. National Institute of Standards and Technology (NIST). NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. Section 3.2

"Privacy Risks

" discusses how IoT devices can create privacy risks by observing individuals' private spaces and collecting sensitive personal information

a concern that is paramount in the healthcare context.

3. Alsubaei

F.

Abuhussein

A.

& Shiva

S. (2017). IoT in Healthcare: A Review of Security and Privacy Challenges

and Solutions. In 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud) (pp. 298-302). This academic paper highlights that "protecting the privacy and security of patients’ data is a major concern" in healthcare IoT systems due to the sensitivity of the data collected. (DOI: 10.1109/CSCloud.2017.61)

4. MIT OpenCourseWare. HST.936: Medical Artificial Intelligence. Course materials emphasize the ethical and regulatory frameworks surrounding health data

including the importance of privacy and security in the design of new healthcare technologies

which is a core principle for developing healthcare IoT products. (Reference: MIT OCW

HST.936

Fall 2022

Lecture 18: Ethics

Privacy

and Regulation).

Symmetric encryption standards, such as the Advanced Encryption Standard (AES), are the most appropriate choice for encrypting large datastores. These algorithms are designed for high performance and computational efficiency, allowing for the rapid encryption and decryption of large volumes of data (bulk data). Asymmetric encryption is significantly slower and more resource-intensive, making it impractical for this purpose. Symmetric encryption uses a single shared key, which is optimized for high-throughput operations required for encrypting entire databases, file systems, or archives.

A. Asymmetric encryption standards: These are computationally intensive and much slower than symmetric standards, making them unsuitable for encrypting large amounts of data. They are typically used for key exchange.

C. Elliptic curve cryptography (ECC): This is a type of asymmetric encryption. While it offers strong security with smaller key sizes, it is still not designed for bulk data encryption due to performance overhead.

D. Diffie-Hellman (DH) algorithm: This is a key exchange protocol, not an encryption algorithm. It is used to securely establish a shared secret key over an insecure channel, which is then used by a symmetric algorithm.

1. National Institute of Standards and Technology (NIST) Special Publication 800-57 Part 1

Revision 5

Recommendation for Key Management.

Section 5.1

"Cryptographic Mechanisms

" Page 20: "Symmetric-key algorithms are more efficient (i.e.

faster) than asymmetric-key algorithms for protecting data. Therefore

symmetric-key algorithms are typically used to protect data (e.g.

for confidentiality or integrity)

while asymmetric-key algorithms are used to establish symmetric keys..." This directly supports using symmetric algorithms for bulk data protection.

2. Purdue University

Department of Computer Science

CS 42600

Computer Security.

"Symmetric Key vs. Public Key Cryptography" Lecture Notes: "Symmetric key crypto is much faster (100x to 1000x) than public key crypto. It is used for encrypting large amounts of data." This academic courseware confirms the performance advantage and primary use case for symmetric encryption.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson.

Chapter 2.1

"Symmetric Cipher Model

" and Chapter 9.1

"Public-Key Cryptography and RSA": The text consistently explains that symmetric ciphers are used for encrypting large amounts of data (e.g.

a file or a database)

while public-key (asymmetric) systems are used for key management and digital signatures due to their slow performance.

After an attacker gains initial access to a user's machine, their most critical and immediate objective is to solidify and improve their position. Escalating privileges from a standard user account to an administrative or SYSTEM/root account is the most effective way to achieve this. Gaining elevated privileges allows the attacker to bypass local security controls, install persistent software, access protected data such as credentials from memory (e.g., LSASS), and gain unrestricted ability to perform further actions like internal reconnaissance. While some reconnaissance is possible with low privileges, securing a stable, high-privilege foothold is the tactical priority before expanding operations within the network.

A. Start log scrubbing: This action is used to cover tracks and evade detection. It is typically performed much later in the attack lifecycle, after the primary objectives have been met.

C. Perform port scanning: This is a specific reconnaissance technique. While it is a post-exploitation activity, it is more effectively and stealthily performed after privileges have been escalated to bypass host-based firewalls and use more powerful scanning tools.

D. Initiate reconnaissance: While some local reconnaissance is necessary to find an escalation vector, the primary goal or action is the escalation itself. Gaining full control of the asset (privilege escalation) is the key enabler for all meaningful subsequent actions, including comprehensive network reconnaissance.

1. MITRE ATT&CK® Framework: The ATT&CK Enterprise Matrix outlines adversary tactics. While Discovery (TA0007) and Privilege Escalation (TA0004) are both post-compromise tactics

Privilege Escalation is fundamental to gaining the level of control needed to effectively execute other tactics. Gaining higher-level permissions is a primary step to "break out of a restricted shell or lower-privileged process."

Source: MITRE. (2023). ATT&CK Enterprise Matrix

Tactic TA0004: Privilege Escalation. Retrieved from https://attack.mitre.org/tactics/TA0004/

2. NIST Special Publication 800-115: This guide on security testing describes the typical phases of a penetration test. After gaining initial access ("Vulnerability Exploitation")

the next phase involves escalating privileges to gain administrative access to the system

which then facilitates deeper access into the network.

Source: National Institute of Standards and Technology. (2008). Technical Guide to Information Security Testing and Assessment (NIST SP 800-115). Section 4.3

"Penetration Testing

" describes the phase following initial exploitation as gaining further access

for which privilege escalation is a key technique.

3. University Courseware on Penetration Testing: Methodologies taught in cybersecurity programs emphasize securing access after exploitation. For example

course materials often detail how initial access yields a low-privilege shell

and the immediate next objective is to escalate to a higher-privilege user to control the system before proceeding with network-level discovery.

Source: Georgia Institute of Technology. (n.d.). CS 6265 Information Security Lab

Lab 3: Binary Exploitation. This and similar academic exercises demonstrate the standard attack flow where exploiting a vulnerability leads to a shell

and the subsequent challenge is to escalate privileges to gain root access on the system.

Public Key Infrastructure (PKI) is a framework that uses public-key cryptography to manage digital certificates and identities. For secure software delivery, a manufacturer uses its private key to create a digital signature for the software package. This signature is then bundled with the software. The IoT device, which has the manufacturer's public key pre-installed in a trusted root store, can use this key to verify the signature. This process confirms both the software's authenticity (it genuinely came from the manufacturer) and its integrity (it has not been altered since being signed), directly meeting the requirement for verification prior to installation.

A. Advanced Encryption Standard (AES): AES is a symmetric encryption algorithm. It provides confidentiality (secrecy) but does not inherently provide a mechanism to verify the authenticity or integrity of the software's origin.

C. Generic Routing Encapsulation (GRE): GRE is a network tunneling protocol used to encapsulate packets. It does not provide any native encryption or mechanisms for verifying the authenticity of the software payload it carries.

D. Internet Protocol Security (IPsec): IPsec secures communication at the network layer between two endpoints (e.g., a server and a device). It does not verify the integrity or authenticity of the software file itself, only the data packets in transit.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-193

Platform Firmware Resiliency Guidelines.

Reference: Section 3.2

"Protection

" states: "To detect unauthorized changes

the platform MUST be able to verify the integrity and authenticity of all protected code... This verification is typically done using cryptographically-sound techniques

such as digital signatures." This directly supports using a signature-based approach

which is a core component of PKI.

2. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017.

Reference: Lecture 9 Notes

"Public-Key Cryptography: RSA

" explains the digital signature process: "To sign message m

Alice computes s = m^d mod n... Anyone can verify the signature by checking that s^e mod n = m." This foundational principle is what PKI uses to ensure software authenticity and integrity.

3. National Institute of Standards and Technology (NIST) Interagency Report 8259A

IoT Device Cybersecurity Capability Core Baseline.

Reference: Section 4.3

"Device Software and Firmware Integrity (SFI)

" specifies the capability: "The IoT device has a mechanism to verify the integrity of software/firmware... using a secure and trusted process." The document's notes elaborate that this is often achieved via "cryptographically signed software/firmware." PKI is the framework that enables and manages this signing process at scale.

Data security is typically categorized into three states: data in motion (during transmission), data at rest (in storage), and data in use (during processing). The scenario describes protections for the first two states using encryption. However, for a standard CPU to perform computations, data must be decrypted and loaded into system memory (RAM). While in this "in use" state, the unencrypted, plaintext data is vulnerable to memory-scraping malware, unauthorized privileged access, or side-channel attacks that can read the contents of RAM. Therefore, even with robust encryption for data at rest and in motion, a significant privacy risk remains during the processing phase.

A. Hashing is a cryptographic function used to ensure data integrity (that data has not been altered), not confidentiality or privacy. The question is about privacy.

C. This is incorrect because it ignores the third state of data. Securing data at rest and in motion does not automatically secure it while it is being actively processed.

D. This assumes the universal presence of advanced technologies like secure enclaves (e.g., Intel SGX, AMD SEV). Such confidential computing features are not standard on all IoT hardware.

---

1. Microsoft Azure Documentation

"Confidential computing overview." Microsoft Corporation

2023. In the section "The problem: Data in use is vulnerable

" it states

"Before confidential computing

any data in use was typically unencrypted and vulnerable... For data to be processed

it must be in memory. This leaves data in memory vulnerable to attacks..." This official vendor documentation confirms that data is vulnerable during processing

supporting the correct answer.

2. Intel Corporation

"Intel® Software Guard Extensions (Intel® SGX) For Dummies®." John Wiley & Sons

Inc.

2021. Chapter 1

"Understanding the Need for Better Security

" p. 8. The document explains

"Data is encrypted when it’s at rest... and in transit... But when data is in use

it’s decrypted and in the clear. This state is when data is most vulnerable." This supports the reasoning that data in use is a critical point of vulnerability and refutes the assumption in option D.

3. David

E.

& Riley

L. (2021). Computer Security: A Hands-on Approach (3rd ed.). Chapter 12

"Memory Forensics." This university-level textbook details methods

such as memory acquisition and analysis

that can be used to extract sensitive data (like passwords and encryption keys) directly from a system's RAM

demonstrating the tangible risks to data "in use."