CertNexus Certified Internet of Things Practitioner (CIoTP) — Exam ITP-110 — Questions and Answers

Question 1: What is a 'botnet' in the context of IoT security threats?

A network of compromised IoT devices controlled by an attacker (Correct answer)
A secure network of trusted IoT devices
A protocol for device discovery
A firewall system for IoT networks

Correct answer: A network of compromised IoT devices controlled by an attacker

An IoT botnet is a collection of compromised devices that an attacker controls remotely, often used to launch DDoS attacks.

Question 2: Ron is the IT director at a medium-sized company and is constantly bombarded by requests from users who want to select customized mobile devices. He decides to allow users to purchase their own devices. Which type of policy should Ron implement to include the requirements and security controls for this arrangement?

Acceptable use
Bring Your Own Device (BYOD) (Correct answer)
Data classification
Privacy

Correct answer: Bring Your Own Device (BYOD)

A Bring Your Own Device (BYOD) policy outlines the rules, requirements, and security controls for employees who use their personal mobile devices for work-related activities. This policy addresses concerns such as data security, acceptable use, device management, and support. Implementing a BYOD policy ensures that personal devices accessing company resources meet organizational security standards.

Question 3: Which Internet of Things (IoT) challenge involves the difficulty of developing and implementing protocols that allow devices to communicate in a standard fashion?

Compliance
Interoperability (Correct answer)
Privacy
Security

Correct answer: Interoperability

Interoperability is a significant challenge in IoT, referring to the difficulty of diverse devices, systems, and applications from different manufacturers communicating seamlessly. Without standardized communication protocols and data formats, devices struggle to understand each other. This hinders the creation of cohesive and functional IoT ecosystems.

Question 4: What does AWS Greengrass extend to IoT edge devices?

AWS Lambda functions, ML inference, data sync, and IoT capabilities to edge devices even without internet connectivity (Correct answer)
AWS storage directly to devices
AWS billing to field devices
Green energy monitoring to AWS

Correct answer: AWS Lambda functions, ML inference, data sync, and IoT capabilities to edge devices even without internet connectivity

AWS Greengrass extends cloud capabilities including Lambda functions, machine learning inference, and local data processing to IoT edge devices for offline operation.

Question 5: Which privacy regulation affects US IoT manufacturers regarding data collected from children under 13?

COPPA (Correct answer)
CCPA
HIPAA
GDPR

Correct answer: COPPA

COPPA (Children's Online Privacy Protection Act) requires IoT manufacturers to obtain parental consent before collecting data from children under 13.

Question 6: Which attack type floods an IoT device or network with traffic to make it unavailable to legitimate users?

Replay Attack
Brute Force
Phishing
Denial of Service (DoS) (Correct answer)

Correct answer: Denial of Service (DoS)

A Denial of Service (DoS) attack overwhelms an IoT device or network with traffic, causing it to become unresponsive.

Question 7: Which concept describes the practice of processing only significant IoT data changes rather than transmitting every reading?

Data replication
Data normalization
Delta transmission or exception reporting (Correct answer)
Data deduplication

Correct answer: Delta transmission or exception reporting

Delta transmission or exception reporting only sends IoT data when values change beyond a threshold, reducing bandwidth and storage requirements.

Question 8: What is the primary purpose of AWS IoT Rules Engine?

Routing and filtering IoT messages to AWS services based on SQL-like queries (Correct answer)
Enforcing IoT security policies
Setting device compliance rules
Managing IoT device billing rules

Correct answer: Routing and filtering IoT messages to AWS services based on SQL-like queries

The AWS IoT Rules Engine uses SQL-like queries to filter and route incoming device messages to other AWS services like DynamoDB, Lambda, and S3.

Question 9: What is anomaly detection in IoT data analytics used for?

Encrypting sensor readings
Scheduling device maintenance manually
Compressing IoT data for storage
Identifying data points that deviate significantly from expected patterns, indicating potential failures or security threats (Correct answer)

Correct answer: Identifying data points that deviate significantly from expected patterns, indicating potential failures or security threats

Anomaly detection algorithms identify unusual patterns in IoT sensor data that could indicate equipment failures, security breaches, or process deviations.

Question 10: What is a 'replay attack' in IoT security?

Looping firmware update attempts
Replaying video footage from security cameras
Capturing and retransmitting valid data packets to deceive a system (Correct answer)
Resetting a device to factory settings

Correct answer: Capturing and retransmitting valid data packets to deceive a system

A replay attack captures valid IoT communications and retransmits them to trick the receiving device into performing unauthorized actions.

Question 11: Which of the following IoT gateway must provide?

Security with hardware
Data Storage
Protocol abstraction (Correct answer)
Simple and fast installation

Correct answer: Protocol abstraction

An IoT gateway serves as a critical bridge between diverse IoT devices and the cloud or other networks. Since devices often use various proprietary or low-power communication protocols (e.g., Zigbee, Bluetooth), while the cloud typically uses standard internet protocols (e.g., HTTP, MQTT), the gateway must provide protocol abstraction. This involves translating data between these disparate protocols to ensure seamless interoperability and data flow across the IoT ecosystem.

Question 12: Which database type is most commonly used to store and query large volumes of IoT time-series sensor data?

Relational SQL database
Document store
Graph database
Time-series database (TSDB) (Correct answer)

Correct answer: Time-series database (TSDB)

Time-series databases like InfluxDB or TimescaleDB are optimized for storing, retrieving, and analyzing timestamped IoT sensor data at scale.

Question 13: What is the purpose of an Intrusion Detection System (IDS) in an IoT network?

To manage firmware updates
To monitor network traffic and alert on suspicious activity (Correct answer)
To encrypt device storage
To assign IP addresses to devices

Correct answer: To monitor network traffic and alert on suspicious activity

An IDS monitors IoT network traffic for suspicious patterns or known attack signatures and generates alerts when threats are detected.

Question 14: What does 'horizontal scalability' mean for an IoT platform backend?

Adding more server instances in parallel to handle increasing IoT device connections and data volume (Correct answer)
Expanding the physical footprint of IoT devices
Increasing the CPU power of a single server
Extending the wireless range of IoT gateways

Correct answer: Adding more server instances in parallel to handle increasing IoT device connections and data volume

Horizontal scalability means adding more server instances to distribute IoT workload, enabling the platform to handle millions of concurrent device connections.

Question 15: What is the AWS IoT SiteWise service specifically designed for?

Providing GPS tracking for IoT assets
Collecting, organizing, and analyzing data from industrial equipment and processes (Correct answer)
Managing residential smart home devices
Managing retail IoT point-of-sale devices

Correct answer: Collecting, organizing, and analyzing data from industrial equipment and processes

AWS IoT SiteWise is a managed service purpose-built for collecting, organizing, and analyzing data from industrial equipment, OPC-UA servers, and manufacturing processes.

Question 16: Which scenario presents a unique challenge for developers of mobile applications?

Applying encryption to network communications
Obtaining Internet Protocol (IP) addresses
Selecting multiple items from a list (Correct answer)
Using checkboxes

Correct answer: Selecting multiple items from a list

Mobile applications often operate on devices with limited screen space and rely heavily on touch interactions. Designing an intuitive and efficient user interface for selecting multiple items from a list, especially long ones, presents a unique challenge to ensure ease of use without accidental selections or frustration. Developers must carefully consider interaction patterns like long-press, checkboxes, or drag-and-select to optimize the user experience on smaller screens.

Question 17: Which security practice assigns each IoT device a unique identity to verify legitimate access?

Firewall filtering
Data encryption
Device authentication (Correct answer)
Network segmentation

Correct answer: Device authentication

Device authentication assigns unique credentials such as certificates or keys to each IoT device, allowing the platform to verify that only authorized devices can connect.

Question 18: What does 'observability' mean in the context of IoT infrastructure operations?

The ability to physically see IoT devices in the field
Installing cameras to monitor IoT hardware
Visibility into device power consumption
The ability to understand the internal state of IoT systems from their external outputs (logs, metrics, traces) (Correct answer)

Correct answer: The ability to understand the internal state of IoT systems from their external outputs (logs, metrics, traces)

Observability in IoT operations means having sufficient logs, metrics, and traces to understand why a system is behaving a certain way without needing to inspect it directly.

Question 19: What is 'containerization' used for in IoT edge deployments?

Encrypting data containers on edge devices
Packaging edge applications with their dependencies for consistent, portable deployment across diverse edge hardware (Correct answer)
Managing IoT power supply units
Physically packaging IoT sensors for shipment

Correct answer: Packaging edge applications with their dependencies for consistent, portable deployment across diverse edge hardware

Containerization (e.g., Docker) packages edge applications with all dependencies, enabling consistent deployment across heterogeneous IoT edge hardware without compatibility issues.

Question 20: In IoT design, what is the benefit of using 'asynchronous communication' over synchronous request-response?

Simpler device programming
Lower data security requirements
Lower data transmission costs
Devices can send data without waiting for an acknowledgment, improving throughput and resilience to temporary connectivity loss (Correct answer)

Correct answer: Devices can send data without waiting for an acknowledgment, improving throughput and resilience to temporary connectivity loss

Asynchronous communication allows IoT devices to send messages and continue operating without blocking, making them resilient to temporary network outages and improving overall system throughput.

Question 21: Which protocol is used by Amazon Alexa and Google Home to discover and control smart home devices on a local network?

UPnP/SSDP (Correct answer)
XMPP
CoAP
MQTT

Correct answer: UPnP/SSDP

UPnP (Universal Plug and Play) and SSDP (Simple Service Discovery Protocol) are used for device discovery on local networks by many smart home platforms.

Question 22: In IoT analytics, what does 'data labeling' refer to in the context of supervised machine learning?

Annotating historical IoT sensor data with known outcomes to train predictive models (Correct answer)
Adding metadata tags to IoT device configurations
Naming data streams in a database
Labeling physical IoT devices with asset tags

Correct answer: Annotating historical IoT sensor data with known outcomes to train predictive models

Data labeling annotates historical IoT sensor data with known outcomes (e.g., 'normal' or 'failure') so supervised learning models can learn to recognize those conditions.

Question 23: Which IoT security framework was developed by NIST to provide guidelines for managing IoT cybersecurity risks?

PCI DSS
NIST Cybersecurity Framework (Correct answer)
OWASP IoT Top 10
ISO 27001

Correct answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework provides guidelines and best practices for managing cybersecurity risk, including for IoT deployments.

Question 24: What is the IBM Watson IoT Platform designed to provide?

Physical IoT device manufacturing services
A cloud platform for device registration, connectivity, data management, and Watson AI-powered analytics for IoT (Correct answer)
IBM mainframe connectivity for legacy IoT devices
Watson AI writing assistance for IoT documentation

Correct answer: A cloud platform for device registration, connectivity, data management, and Watson AI-powered analytics for IoT

IBM Watson IoT Platform provides IoT device management, MQTT-based connectivity, data storage, and integration with Watson AI services for IoT analytics.

Question 25: What is 'edge analytics' in an IoT deployment?

Analytics at the network's geographic boundary
Analytics performed only in the cloud
Analysis of network edge security threats
Processing and analyzing IoT data at or near the device rather than sending it all to the cloud (Correct answer)

Correct answer: Processing and analyzing IoT data at or near the device rather than sending it all to the cloud

Edge analytics processes IoT data locally on edge devices or gateways, reducing latency and bandwidth by analyzing data before it reaches the cloud.

Question 26: Which US state passed the first IoT-specific cybersecurity law (SB-327) requiring reasonable security features in connected devices?

Texas
Florida
California (Correct answer)
New York

Correct answer: California

California's SB-327, effective January 2020, was the first US law requiring IoT device manufacturers to implement reasonable security features.

Question 27: Which service in GCP is typically used to stream real-time IoT telemetry data into analytics pipelines?

Cloud Pub/Sub (Correct answer)
Cloud Spanner
Cloud Storage
Cloud SQL

Correct answer: Cloud Pub/Sub

Google Cloud Pub/Sub is the real-time messaging service used to ingest and distribute high-volume IoT telemetry data streams into downstream analytics and storage services.

Question 28: What does 'data normalization' mean when preparing IoT sensor data for analytics?

Scaling data values to a standard range to remove bias due to different measurement units (Correct answer)
Deleting duplicate sensor readings
Encrypting data for secure storage
Converting data to JSON format

Correct answer: Scaling data values to a standard range to remove bias due to different measurement units

Data normalization scales IoT sensor readings to a common range so that variables with different units don't disproportionately influence analytics models.

Question 29: What is the role of a Public Key Infrastructure (PKI) in IoT security?

To monitor device power consumption
To synchronize device clocks
To manage digital certificates for device identity and encryption (Correct answer)
To provide wireless connectivity

Correct answer: To manage digital certificates for device identity and encryption

PKI manages digital certificates used to authenticate IoT device identities and establish encrypted communications.

CertNexus Certified Internet of Things Practitioner (CIoTP) — Exam ITP-110

The CIoTP certification validates foundational knowledge of IoT concepts, technologies, and tools across the IoT ecosystem, covering design, implementation, operation, and management for practitioners in diverse IoT-related roles.

Questions

35 min

Time Limit

60%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds