ITS-110 Sample Questions & Answers

The most direct and effective countermeasure against attacks via debug ports is to disable them completely in the final production version of the firmware. This is often done by blowing an eFuse on the microcontroller, making the change irreversible. While encryption is important, an attacker with debug access could potentially bypass it. Tamper-evident seals detect attacks but don't prevent them, and network access control is irrelevant to this physical attack vector.

While TLS certificates and username/password handle authentication (who the device is), they do not control authorization (what the device is allowed to do). Topic-based Access Control Lists (ACLs) are the specific mechanism used in MQTT brokers to enforce rules about which clients can publish or subscribe to specific topic patterns. This directly addresses the principle of least privilege required by the scenario.

Data minimization is the principle of collecting and retaining only the data that is strictly necessary for a specific purpose. An 'event-only' recording mode directly applies this principle by avoiding the collection of continuous, unnecessary footage and only capturing data relevant to a security event (motion). The other options either increase data collection or relate to security and transparency, not minimization.

The payload ' OR '1'='1' is a classic SQL injection technique. The attacker is attempting to manipulate the backend SQL query by appending a condition that always evaluates to true, potentially bypassing authentication or retrieving all records from a database table. XSS involves injecting client-side scripts, CSRF tricks a user into performing an unwanted action, and path traversal involves accessing files outside the intended directory.

Adding random noise makes it much harder for an attacker to isolate the small power fluctuations related to cryptographic operations.

Constant-time algorithms ensure that operations take the same amount of time and similar power regardless of the data being processed, removing data-dependent variations an attacker could exploit.

Blinding involves randomizing the input to a cryptographic function so that the power consumption patterns are decorrelated from the actual secret key or data.

Anti-rollback protection is a specific security feature that prevents a device from accepting and installing a firmware version that is older than the one currently installed. This is typically implemented by storing the current version number in a secure, one-way modifiable location (like an eFuse or trusted storage) and rejecting any update with a lower version number. Secure boot and code signing are related but do not inherently prevent downgrades.

The 'Right to Access' (also known as the 'Right of Access' or linked to 'Data Portability' in regulations like GDPR) is the specific right of individuals (data subjects) to obtain a copy of their personal data that is being processed by an organization. This allows users to understand what data is held about them and to verify its lawfulness.

VLANs (Virtual Local Area Networks) allow a network administrator to logically segment a single physical network into multiple, isolated broadcast domains. This is the standard method for separating traffic (like industrial sensors vs. corporate data) on the same physical switch infrastructure. Air gapping requires separate physical hardware, a VPN is for remote access, and a DMZ is typically for external-facing services.

OAuth 2.0 is the industry-standard protocol for authorization, allowing applications to obtain limited access to user accounts on an HTTP service. OpenID Connect (OIDC) is a simple identity layer built on top of OAuth 2.0 that provides authentication. This combination is perfectly suited for modern web/cloud applications, supporting third-party identity providers and token-based API security. RADIUS, LDAP, and Kerberos are older protocols not typically used for this type of web-centric, federated identity scenario.

STRIDE is a mnemonic for six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The act of pretending to be another entity (in this case, the user's smartphone) falls directly under the 'Spoofing' category.