312-50 Question 410
Single answer▪ IoT ConceptsDuring an authorized security assessment of a smart manufacturing facility, you discover several IoT environmental sensors connected through a local gateway. The sensors periodically publish temperature and humidity data to the gateway, which then forwards the data to a cloud dashboard. Packet captures show that the sensors communicate using MQTT on TCP port 1883, and the broker accepts client connections without requiring authentication or TLS. The client IDs are easy to predict, and the topics include production-line identifiers. Which action would present the MOST realistic and immediate security risk in this scenario?
- A
Subscribing to the sensors' MQTT topics to passively collect production data and infer operational activity
- B
Exploiting SNMP write access on the sensors to reconfigure their network settings remotely
- C
Launching a SQL injection attack against the cloud dashboard through the MQTT broker
- D
Using Bluetooth pairing attacks to take control of the sensors from the parking lot
Show answer and explanation
Correct answer: A
Explanation
The key IoT security issue in this scenario is insecure MQTT deployment. MQTT is widely used in IoT because it is lightweight, but by default it does not provide encryption or authentication unless implemented with controls such as TLS, broker authentication, and access control lists. Port 1883 is typically associated with plaintext MQTT, while secure MQTT commonly uses TLS on port 8883. In a real assessment, an unauthenticated broker with predictable client IDs and topic names creates immediate opportunities for passive reconnaissance and data exposure, and in some environments could also enable unauthorized publishing. Best practices from MQTT security guidance and IoT security frameworks emphasize broker authentication, per-topic authorization, certificate-based transport security, and minimizing information leakage in topic naming. From a CEH perspective, the most realistic first risk to identify is unauthorized subscription to exposed topics, because it directly follows from the observed evidence and demonstrates how weak IoT messaging controls can leak sensitive operational data.
- A. Correct.
Correct. MQTT over port 1883 commonly indicates unencrypted, non-TLS transport unless explicitly secured. If the broker allows unauthenticated connections and topics are predictable, an attacker can realistically subscribe to those topics and eavesdrop on telemetry. In an IoT environment, even seemingly harmless sensor data can reveal production schedules, equipment usage, and operational states. This is an immediate and practical risk because it requires no exploit development, only access to the broker and knowledge of topic structure.
- B. Incorrect.
Incorrect. SNMP write access could be dangerous, but the scenario provides no evidence that SNMP is enabled on the sensors or accessible. This option is plausible because networked devices often expose management services, but it goes beyond the facts presented. A CEH candidate should prioritize the risk directly supported by the observed configuration: open MQTT access.
- C. Incorrect.
Incorrect. SQL injection targets application inputs interpreted by a SQL backend. MQTT is a messaging protocol, and the scenario does not indicate any injectable application parameter or vulnerable web input. While poor backend handling of MQTT payloads can sometimes lead to downstream issues, claiming SQL injection through the broker is not the most immediate or realistic conclusion from the evidence given.
- D. Incorrect.
Incorrect. Bluetooth attacks are a common IoT concern, but the scenario specifically describes sensors communicating via MQTT over TCP through a local gateway. There is no indication that Bluetooth is used for management or data transport. This distractor reflects a common misconception that all IoT devices are primarily attacked over short-range wireless protocols.