AP Cybersecurity Drill 15: IoT Devices in a Warehouse

Question 1. Reading the table, which device shows the clearest combination of weaknesses an attacker could use from outside the warehouse?

• A) The temperature sensors, because they present no login at all on their simple read-only display screen
• B) The loading-dock controller, because it has its automatic software-update feature switched fully on
• C) The smart thermostat, because the thermostat device's firmware was last updated only about a month ago or so
• D) The door-camera hub, with a default admin login, no installed updates, and direct internet reachability ✓

Explanation: Choice D is correct. The door-camera hub combines a publicly known default login, missing updates, and direct internet reachability, which together give an outside attacker an easy and exposed way in. Choice A is incorrect. The temperature sensors have no login and report only to the building system, so they offer little outside foothold. Choice B is incorrect. Auto-updating and an internal-only address make the loading-dock controller relatively well-protected. Choice C is incorrect. A recently updated thermostat with a strong password and internal-only access is among the safer devices.

Question 2. Why is the door-camera hub's unchanged factory-default login (admin / admin) a serious vulnerability?

• A) Because default administrative credentials only ever matter on devices that record and store video footage
• B) Because default credentials are often documented or widely known, so anyone who reaches the device can log in ✓
• C) Because leaving the factory-default admin login in place noticeably slows down the camera hub's performance
• D) Because continuing to use a default login stops the camera hub from being able to connect to the Wi-Fi at all

Explanation: Choice B is correct. Default credentials are often published in manuals, listed in online databases, or otherwise widely known, so an unchanged admin / admin login lets anyone who can reach the device log in without guessing or cracking. Choice A is incorrect. Default credentials are a risk on any device that has a login, not only ones that store video. Choice C is incorrect. Default logins do not affect device speed. Choice D is incorrect. Default credentials do not prevent network connectivity; the hub is in fact reachable from the internet.

Question 3. Which set of fixes should the engineer apply first to the door-camera hub?

• A) Change the default password to a unique strong one, apply the available updates, and stop exposing it online ✓
• B) Unplug all of the read-only warehouse temperature sensors from the building-management control system entirely
• C) Give the loading-dock controller a brand-new password, even though that controller already has a strong one
• D) Add a second door camera somewhere in the warehouse in order to improve the overall video coverage of the site

Explanation: Choice A is correct. Replacing the default password, installing the missing updates, and removing direct internet exposure address all three of the hub's weaknesses at once and close the easiest path in. Choice B is incorrect. The read-only temperature sensors are not the exposure, so unplugging them does not fix the hub. Choice C is incorrect. The loading-dock controller already has a strong unique password; changing it does nothing about the hub. Choice D is incorrect. Adding a camera increases the device count without fixing the vulnerable hub.

Question 4. The engineer notes that the warehouse network is flat. Why does a compromised door-camera hub create risk beyond the camera feed itself?

• A) Because network cameras generally tend to record their video at a higher resolution than other warehouse gear
• B) Because a compromised camera hub can only ever expose its own video feed, so the rest of the network stays safe
• C) Because on a flat network the hub can reach other devices, serving as a foothold toward controller and systems ✓
• D) Because once the camera hub has been compromised, all of its stored images would then be deleted automatically

Explanation: Choice C is correct. On a flat network every device can reach every other device, so a compromised internet-facing hub becomes a foothold from which an attacker can pivot toward the loading-dock controller and building system, extending the damage past the camera feed. Choice A is incorrect. Recording resolution has nothing to do with the lateral-movement risk. Choice B is incorrect. The flat network is exactly why the risk is not limited to the camera's own video; the hub can reach other devices. Choice D is incorrect. Nothing indicates camera images would be auto-deleted, and that is not the network risk.

Question 5. Beyond fixing the hub, which change best reduces the risk that any single compromised IoT device endangers the others?

• A) Place IoT devices on isolated segments with rules limiting device-to-device traffic, so one compromised device cannot freely reach the others ✓
• B) Give every one of the IoT devices on the network the very same single shared password so that staff have an easier time managing and logging in to all of them
• C) Connect all of the IoT devices directly to the public internet so that staff can reach and manage every one of them remotely from anywhere with far less effort
• D) Remove the strong passwords from the devices that have them so staff can log in to them faster

Explanation: Choice A is correct. Segmenting IoT devices and restricting allowed traffic between them contains a compromise; taking over one device should not automatically give an attacker access to the other IoT devices or the main network. Choice B is incorrect. A shared password means cracking one device exposes them all, worsening the risk. Choice C is incorrect. Exposing every device to the internet multiplies the attack surface rather than reducing it. Choice D is incorrect. Removing strong passwords weakens the devices that are currently well-protected.