300-220 Question #3: Real Exam Question with Answer & Explanation

Question

Options

• AReviewing the device's physical security mechanisms
• BAnalyzing the operating system's security features
• CChecking for updates to the device firmware
• DApplication behavior analysis

Explanation

Analyzing operating system security features (B) and application behavior (D) are core components of IoT threat analysis because they address the software attack surface where most exploits occur - a compromised OS or a misbehaving application are primary vectors for data exfiltration, privilege escalation, and lateral movement. OS security features (e.g., privilege separation, secure boot, encryption) define the device's fundamental resilience, while application behavior analysis reveals anomalies like unexpected network calls or unauthorized data access that indicate active threats or malware.

Why A is wrong: Physical security is an important hardening consideration but is not a standard component of threat analysis - it falls under physical security controls, not software threat modeling.

Why C is wrong: Checking for firmware updates is a remediation/maintenance activity, not threat analysis. It addresses known vulnerabilities but doesn't analyze the threat landscape of the device itself.

Memory tip: Think "OS + App = Threat Analysis core" - you analyze what the device runs (OS) and what it does (app behavior). Physical checks and firmware updates are before/after steps (hardening and patching), not analysis.

No community discussion yet for this question.