Hardening Targets

Question 1 of 6

A company deploys 200 IoT temperature sensors in its manufacturing facility. The sensors are placed on the corporate network alongside workstations and servers. Six months later, an attacker compromises one sensor via a known default password and uses it to scan and attack internal database servers. Which hardening control, if in place, would have most directly limited the attacker's ability to reach the database servers from the compromised sensor?

Applying the latest firmware update to all sensors Changing the default credentials on all sensors Segmenting all IoT devices onto a dedicated VLAN with no route to corporate systems Installing EDR software on the sensors

Question 2 of 6

An attacker gains access to the laptop used by a cloud administrator. The laptop has stored AWS CLI credentials and an active AWS Console session with administrator rights. The attacker creates a new IAM administrator account, exfiltrates data, and deletes backup buckets. Which cloud hardening control would have most directly limited the damage by preventing the attacker from creating a new administrator account?

Cloud-to-Cloud backup to a second provider Least privilege — scoping the administrator's permissions to only what their role requires, not including IAM user creation Applying the latest OS patches to the administrator's laptop Backing up all EC2 instances nightly

Question 3 of 6

A security administrator is hardening a SCADA system that controls a water treatment facility's chemical dosing process. The administrator asks what the primary network security requirement is. Which answer is correct?

The SCADA system should be accessible from the internet so operators can monitor it remotely The SCADA system should be on the same network as corporate workstations to simplify management The SCADA system should be isolated from corporate IT networks and have no direct internet access — air-gapped or extensively segmented The SCADA system should use the same antivirus software as workstations to maintain consistent protection

Question 4 of 6

A Real-Time Operating System (RTOS) is used to control an industrial robot arm in a manufacturing facility. A network engineer proposes connecting the RTOS to the corporate network for centralized monitoring. Why is this a security and operational concern?

RTOSes do not support network connections of any kind Network connectivity could introduce timing variability that disrupts the RTOS's deterministic processing schedule, and it introduces network-based attack vectors into a safety-critical system RTOSes use proprietary protocols that are incompatible with corporate network equipment Corporate network monitoring would generate excessive logs from the RTOS

Question 5 of 6

A company installs 20 new managed network switches. The IT contractor configures VLANs and routing but does not change the default management credentials. Which hardening principle was violated, and what is the immediate risk?

Least privilege was violated — the switches should only communicate on needed VLANs Default credentials were not changed — any attacker with network access can gain full switch management access using the published defaults Firmware was not updated — the switches may have unpatched vulnerabilities The switches were not registered with the manufacturer — firmware updates cannot be received

Question 6 of 6

An organization uses smartphones for field sales staff. The IT team wants to separate the company's CRM application and email from employees' personal apps, so that if a personal app is malicious, it cannot access corporate data. Which mobile hardening technique addresses this requirement?

Configuring the MDM to perform remote wipe on compromised devices Requiring biometric authentication before the device unlocks Data segmentation — separating corporate data into a managed work profile isolated from personal data Disabling Bluetooth on all company-managed devices

Matching

1. A smart thermostat controlling HVAC for an office building. It ships with a default password of "admin" printed in the product manual. The manufacturer releases security patches infrequently, and the device should be placed on its own isolated VLAN.

2. The control system for a regional power distribution grid. It monitors and controls circuit breakers across 50 substations. It must be on its own isolated network with no internet access because compromise could cause power outages affecting thousands of customers.

3. An operating system controlling anti-lock braking in an automobile. It must respond to wheel sensor data within 5 milliseconds. Any timing delay causes a safety failure. It runs only the services required for braking control and is isolated from all other vehicle networks.

4. A purpose-built industrial sensor with firmware permanently written at manufacture. It performs one function — measuring temperature in a chemical reactor — and has no mechanism to receive firmware updates after deployment. It is placed on an isolated segment with a firewall in front.

1. 2. 3. 4.

A. Embedded system

B. SCADA / ICS

C. RTOS

D. IoT

Hardening Targets — Quiz

Matching