CSCU - Certified Secure Computer User Mobile and IoT Device Security Questions and Answers 1 — Questions and Answers
Question 1: A company wants to enforce a security policy that requires all employee-owned smartphones accessing corporate email to have a mandatory PIN and the ability to be remotely wiped if lost or stolen. Which of the following solutions would BEST achieve this?
- A corporate VPN
- Two-factor authentication (2FA)
- Mobile Device Management (MDM) (Correct answer)
- A network firewall
Correct answer: Mobile Device Management (MDM)
Mobile Device Management (MDM) solutions are specifically designed to allow administrators to manage and enforce security policies on mobile devices. This includes capabilities like enforcing PINs, encrypting data, and performing a remote wipe to protect corporate data if a device is lost or stolen.
Question 2: What is a primary security consequence of jailbreaking an iOS device or rooting an Android device?
- It improves the device's battery life.
- It bypasses the operating system's built-in security controls and sandboxing. (Correct answer)
- It automatically encrypts all user data.
- It disables the device's ability to connect to Wi-Fi.
Correct answer: It bypasses the operating system's built-in security controls and sandboxing.
Jailbreaking or rooting a device removes the security restrictions and protections, like app sandboxing, that are built into the mobile operating system. This action grants the user elevated privileges but also makes the device significantly more vulnerable to malware and unauthorized access.
Question 3: A user has several IoT devices, such as smart light bulbs and a smart thermostat, on their home network. To minimize the potential damage if one of these devices is compromised, which of the following is the BEST network security practice?
- Connecting all IoT devices using Ethernet cables instead of Wi-Fi.
- Assigning static IP addresses to each IoT device.
- Placing all IoT devices on a separate, isolated network segment. (Correct answer)
- Disabling the firewall on the main router to improve device communication.
Correct answer: Placing all IoT devices on a separate, isolated network segment.
Network segmentation is a critical security practice for IoT devices. By placing them on a separate network (like a guest Wi-Fi network or a VLAN), you isolate them from your primary computers and data. If an IoT device is compromised, the attacker's access is contained within that segment, preventing them from easily accessing more sensitive systems on the main network.
Question 4: A user receives an SMS text message that warns their bank account has been locked and provides a link to 'verify' their identity. This is a classic example of which type of attack?
- Vishing
- Smishing (Correct answer)
- Bluejacking
- Spear Phishing
Correct answer: Smishing
Smishing is a form of phishing that is conducted using SMS (Short Message Service) text messages. The goal is the same as email phishing: to trick the user into revealing sensitive information or clicking a malicious link, but the medium is a mobile text message.
Question 5: An individual in a crowded public area suddenly receives an unsolicited, anonymous business card contact on their phone via Bluetooth. The contact contains a simple advertising message. What is this activity called?
- Bluesnarfing
- Smishing
- Vishing
- Bluejacking (Correct answer)
Correct answer: Bluejacking
Bluejacking is the act of sending unsolicited messages to other Bluetooth-enabled devices. It is often harmless and used for advertising or as a prank, unlike Bluesnarfing, which involves the unauthorized theft of data from a device via Bluetooth.
Question 6: Upon setting up a new smart security camera, a user connects it to their network without changing the default username and password printed on the device's label. What is the MOST significant security risk of this action?
- The manufacturer's default credentials are often publicly known and can be easily exploited by attackers. (Correct answer)
- The device may consume too much network bandwidth.
- The camera's video resolution might be permanently lowered.
- The device will not be able to receive future firmware updates.
Correct answer: The manufacturer's default credentials are often publicly known and can be easily exploited by attackers.
Many IoT devices are shipped with simple, default credentials (like 'admin'/'password'). These defaults are often well-known and published online. Attackers can run automated scans to find these devices on the internet and gain unauthorized access if the credentials have not been changed, posing a major security and privacy risk.
CSCU - Certified Secure Computer User Mobile and IoT Device Security Questions and Answers 1
A company wants to enforce a security policy that requires all employee-owned smartphones accessing corporate email to have a mandatory PIN and the ability to be remotely wiped if lost or stolen.
Which of the following solutions would BEST achieve this?