Which of the following are considered best practices for IoT device security? (Select two)

Question

Options

• ARegular firmware updates
• BDefault password usage
• CNetwork segmentation
• DDisabling unused services and ports

• A
  87% (34)
• B
  5% (2)
• C
  8% (3)

Explanation

Regular firmware updates (A) patch known vulnerabilities and are a foundational security practice - unpatched firmware is one of the most exploited attack surfaces on IoT devices. Disabling unused services and ports (D) reduces the attack surface by eliminating entry points that serve no operational purpose, a principle known as minimizing the attack surface.

B is wrong because default passwords are a critical security failure - they are publicly documented and the first thing attackers try. Changing default credentials immediately upon deployment is a baseline IoT requirement. C (network segmentation) is actually also a best practice, but since the question asks you to select only two and A and D are the most directly device-level controls, C functions as a plausible distractor testing whether you know the distinction between device-hardening and network-level controls.

Memory tip: Think of the acronym "FUD" - Firmware updates, Unused services/ports disabled - these are the two things you do to the device itself. Network segmentation protects around the device, but A and D harden the device directly.

No community discussion yet for this question.