As a security consultant, you are advising a startup that is developing an IoT device for home security. The device communicates with a mobile app, allowing homeowners to monitor their homes in real…

CAPTCHA is a security measure designed to differentiate human users from automated bots, primarily to prevent brute-force attacks or spam on login screens, not to protect data in transit from interception or manipulation.

SSL/TLS (Secure Sockets Layer/Transport Layer Security) encryption establishes a secure, encrypted channel between the IoT device and the mobile app, ensuring data confidentiality, integrity, and server authentication. This cryptographic protection prevents unauthorized interception, reading, or manipulation of the communication by an attacker positioned between the two communicating parties.

Limiting the range of wireless signals is a physical security control that reduces the physical area an attacker can operate within, but it does not encrypt or secure the data itself if an attacker is within range to intercept the signal.

Frequently changing an IoT device's IP address does not prevent an attacker from intercepting or manipulating data traffic once a connection is established, as MitM attacks operate on the communication channel rather than relying on a static IP for interception.