# SEAS-8414 Chapter 2 Homework

## Blackboard Multiple-Choice Assessment: Service Enrichment and Device Fingerprinting

**Format:** 50 single-correct-answer multiple-choice questions, 2 points each.

**Assessment boundary:** Chapter 2 only. Each item concerns service enrichment, device
fingerprinting, identity evidence, confidence ceilings, CPE candidate construction, source
provenance, or the handoff from enrichment to vulnerability assessment. Each stem contains the
rule, evidence, threshold, or formula needed to answer without using external material.
Several items encode an explicit failure mode, validation/proof condition, trade-off, operator
context, and measured or heuristic evidence rule inside the stem.

**Provenance note:** Each item includes a public scenario-provenance label. The label explains the
real-world setting that inspired the item, but the label is not needed to answer the question.

---

### Question 1

**Scenario provenance only (not needed to answer):** Verkada camera exposure reporting and ONVIF public specifications.

An IoT camera appears in Chapter 1 host discovery with IP `10.42.7.19`. Chapter 2 enrichment receives only this fact: the host exists. The enrichment contract says a device-identity claim requires at least one identity-bearing signal such as OUI, service product, HTTP realm, RTSP banner, ONVIF self-report, SSDP record, mDNS record, or a CPE candidate.

Which record state is consistent with the contract?

(a) Vendor `Hikvision`, model `DS-2CD`, confidence `0.85`
(b) Host `10.42.7.19` exists; identity evidence is absent
(c) CVE candidate list is empty, so the device is unidentified
(d) Device identity is accepted because IP address format is private

### Question 2

**Scenario provenance only (not needed to answer):** IEEE OUI registration and Mirai IoT botnet public reporting.

An OT lab gateway has MAC address `c0:56:e3:11:22:33`. The OUI table maps prefix `c0:56:e3` to Hikvision. The Chapter 2 rule says OUI evidence can support vendor-level identity but cannot determine model, firmware, or service role by itself.

Which identity field set is supported by the evidence?

(a) Vendor Hikvision; model unknown; firmware unknown
(b) Vendor Hikvision; model `DS-2CD2142FWD`; firmware `5.4.0`
(c) Vendor unknown; model Hikvision; firmware unknown
(d) Vendor Dahua; model unknown; firmware unknown

### Question 3

**Scenario provenance only (not needed to answer):** CISA water-sector incident advisory and routed management-network practice.

An OT water controller is discovered from a routed management segment. Chapter 2 local-link probes, including mDNS and SSDP multicast browsing, are configured to run only on the same broadcast domain as the target. The controller is on a different VLAN from the collector.

Which enrichment action follows from the stated probe-routing rule?

(a) Run mDNS and SSDP anyway because the controller is operational technology
(b) Mark the controller absent because multicast probes are skipped
(c) Skip local-link multicast enrichment and preserve the host claim from Chapter 1
(d) Convert the skipped probes into a default-credential finding

### Question 4

**Scenario provenance only (not needed to answer):** Nmap service-version detection reference.

An embedded camera at `10.10.8.22:80` returns an Nmap service string `http server`. No vendor name, product name, realm, certificate subject, or structured device endpoint is present. Chapter 2 treats generic service class strings as service evidence, not device identity.

Which enrichment output is correct?

(a) Vendor is `http`; model is `server`
(b) Port 80 has HTTP service evidence; device vendor remains unknown
(c) A CPE candidate `cpe:2.3:a:http:server:*:*:*:*:*:*:*:*` is accepted
(d) CVE lookup begins because any HTTP service creates a vulnerability candidate

### Question 5

**Scenario provenance only (not needed to answer):** ONVIF Core Specification.

An IoT camera exposes an ONVIF `GetDeviceInformation` response: manufacturer `Axis`, model `M3045-V`, firmware `8.40.3`. The Chapter 2 confidence table assigns ONVIF structured self-report a ceiling of `0.85` when the record is internally consistent and there is no conflicting evidence.

Which identity claim fits that rule?

(a) Vendor Axis, model unknown, confidence `0.40`
(b) Vendor unknown, model `M3045-V`, confidence `0.85`
(c) Vendor Axis, model `M3045-V`, firmware `8.40.3`, confidence at or below `0.85`
(d) Vendor Axis, model `M3045-V`, confirmed CVE exposure

### Question 6

**Scenario provenance only (not needed to answer):** RTSP camera behavior described in public IP-camera administration guides.

An IoT camera on port 554 replies to `OPTIONS rtsp://10.1.2.3/ RTSP/1.0` with `Server: Hikvision Streaming Server 1.0`. Chapter 2 treats an RTSP server banner as identity evidence and Chapter 3 treats vulnerabilities separately.

Which claim is supported at the enrichment stage?

(a) Vendor evidence for Hikvision is present through RTSP
(b) CVE-2017-7921 is confirmed
(c) Default password `12345` is confirmed
(d) Firmware version is known to be patched

### Question 7

**Scenario provenance only (not needed to answer):** RFC 6762 mDNS and RFC 6763 DNS-SD.

A conference-room IoT display answers mDNS with service `_googlecast._tcp.local`, product string `Chromecast`, and ports `8008` and `8009`. Chapter 2 treats mDNS service advertisement plus matching Cast ports as a Cast-device identity signal.

Which identity record is consistent with the evidence?

(a) Unknown IoT display; no identity evidence
(b) Windows workstation because it is in a conference room
(c) Vulnerable camera because it exposes port 8008
(d) Google Cast family device with mDNS provenance

### Question 8

**Scenario provenance only (not needed to answer):** UPnP Device Architecture and SSDP discovery behavior.

A smart-building sensor answers SSDP with a device XML URL. The XML contains `manufacturer=Philips`, `modelName=Hue Bridge`, and `serialNumber=abc123`. The Chapter 2 parser accepts manufacturer and model fields from safe XML parsing, while serial numbers are retained as provenance rather than used as a public CPE name.

Which output is correct?

(a) Discard the XML because XML is never identity evidence
(b) Record Philips Hue Bridge identity evidence and keep the serial as provenance
(c) Publish the serial number as the product name
(d) Convert the SSDP record into a confirmed firmware weakness

### Question 9

**Scenario provenance only (not needed to answer):** Salesforce JARM public fingerprinting reference.

An exposed embedded TLS endpoint has JARM hash `29d29d00029d29d21c29d29d29d29d5f2d...`. The local enrichment rule caps JARM-only identity confidence at `0.60` because different products can share TLS-stack behavior. No HTTP, ONVIF, OUI, or mDNS evidence is available.

Which confidence assignment follows the rule?

(a) `0.95`, because a hash is deterministic
(b) `0.85`, because TLS is cryptographic
(c) `0.60` or lower, because JARM alone is a grouping signal
(d) `0.00`, because TLS never helps enrichment

### Question 10

**Scenario provenance only (not needed to answer):** Public TLS certificate deployment patterns for embedded devices.

A building-access controller presents a self-signed TLS certificate with subject `CN=ACME Door Controller` and issuer `CN=ACME Factory CA`. Chapter 2 uses certificate metadata as identity evidence when vendor or product strings are present, but it does not treat self-signature as proof of trustworthiness.

Which statement is supported?

(a) ACME identity evidence is present; trust status is not established
(b) The certificate proves the controller is uncompromised
(c) The self-signed issuer removes all identity value
(d) The certificate creates a CVSS score

### Question 11

**Scenario provenance only (not needed to answer):** Public printer-administration interface examples.

An IoT printer page title is `Login`. The HTTP `Server` header is `Apache`. The realm string, favicon, model endpoint, and certificate subject contain no vendor or product text. Chapter 2 says generic web-application markers do not identify the device.

Which output is correct?

(a) Vendor Apache, model Login
(b) Printer model confirmed from the page title
(c) CPE candidate accepted for `apache:printer`
(d) HTTP service observed; device identity remains unresolved

### Question 12

**Scenario provenance only (not needed to answer):** Hospital biomedical-device inventory constraints described in FDA cybersecurity guidance.

A biomedical IoT pump is discovered by passive inventory. The HTTP adapter cannot connect because the path is blocked by an access-control list. The enrichment data model distinguishes adapter failure from negative identity evidence.

Which record value preserves that distinction?

(a) `http_identity=false` and `vendor=unknown` because the device has no web interface
(b) `http_adapter_status=failed`; identity evidence from HTTP unavailable
(c) `host_absent=true` because enrichment failed
(d) `default_credentials_failed=true` because HTTP did not answer

### Question 13

**Scenario provenance only (not needed to answer):** Smart-building network segmentation practices and RFC 6762 mDNS.

A collector on VLAN 20 sees an IoT thermostat on VLAN 30 through router telemetry. The mDNS adapter rule says multicast browsing is local-link only unless a relay is explicitly documented. No relay exists.

Which method set is allowed by the rule?

(a) Router/DHCP evidence and unicast service probes; no mDNS browsing
(b) mDNS browsing only
(c) Default-credential testing because mDNS is unavailable
(d) CVE lookup because the thermostat is cross-VLAN

### Question 14

**Scenario provenance only (not needed to answer):** ONVIF and RTSP camera management specifications.

An OT video sensor has open ports `22` and `443` only. Chapter 2 probe routing says RTSP enrichment runs only when port 554 or an RTSP alternate is observed; ONVIF enrichment runs only when an ONVIF service endpoint or known management port is observed.

Which action is consistent with that routing rule?

(a) Run RTSP because all cameras have RTSP
(b) Run ONVIF because port 443 is encrypted
(c) Do not run RTSP or ONVIF without eligible evidence
(d) Mark the device as non-camera

### Question 15

**Scenario provenance only (not needed to answer):** Chapter 2 confidence-ceiling pattern based on public device-fingerprinting literature.

The local confidence table assigns these single-source ceilings: OUI `0.40`, HTTP realm `0.70`, SSDP/mDNS `0.75`, ONVIF self-report `0.85`. A camera has only OUI vendor evidence.

Which confidence ceiling applies?

(a) `0.85`
(b) `0.40`
(c) `0.75`
(d) `1.00`

### Question 16

**Scenario provenance only (not needed to answer):** Mixed-vendor surveillance network incidents reported in public breach analyses.

An IoT camera has OUI vendor `Dahua`, HTTP realm `Hikvision`, and no ONVIF response. Chapter 2 conflict handling says materially conflicting vendor signals must remain visible in the identity artifact rather than being averaged into one silent value.

Which output follows the rule?

(a) Vendor Hikvision only, because HTTP outranks OUI in every case
(b) Vendor Dahua only, because MAC evidence is hardware-level
(c) Vendor Unknown, with all evidence deleted
(d) Conflict record containing Dahua OUI evidence and Hikvision HTTP evidence

### Question 17

**Scenario provenance only (not needed to answer):** NIST CPE Naming specification.

A camera enrichment record has vendor `hikvision`, product family `ip camera`, and no model or firmware version. Chapter 2 permits a broad CPE candidate only when provenance and uncertainty are retained.

Which CPE-style candidate is consistent with that rule?

(a) `cpe:2.3:a:hikvision:ip_camera:*:*:*:*:*:*:*:*`, marked broad
(b) `cpe:2.3:a:hikvision:ds-2cd2142fwd:5.4.0:*:*:*:*:*:*:*`, marked exact
(c) `hikvision.camera.latest`, marked exact
(d) No identity artifact because firmware is missing

### Question 18

**Scenario provenance only (not needed to answer):** NIST CPE Naming specification and public vulnerability-management practice.

Two evidence sources agree on vendor `Axis`; one source says product family `network camera`, and ONVIF says model `M3045-V`. Firmware is absent. The CPE rule ranks model-level product evidence above family-level product evidence when both share the same vendor and no conflict exists.

Which CPE candidate preserves the available precision?

(a) A vendor-only CPE with all product fields wildcarded
(b) A firmware-exact CPE invented from the current date
(c) A model-level Axis `M3045-V` candidate with version wildcarded
(d) A Dahua camera CPE because cameras share protocols

### Question 19

**Scenario provenance only (not needed to answer):** Public Google Cast protocol observations and RFC 6763 DNS-SD.

An IoT media device exposes mDNS `_googlecast._tcp.local`, model `Nest Hub`, and HTTP port `8008`. The enrichment rule says Cast identity can be assigned when Cast mDNS and a compatible service port co-occur.

Which classification is correct?

(a) Unknown host, because mDNS never carries product data
(b) Cast-family smart-display identity with mDNS and port provenance
(c) RTSP camera, because media devices stream video
(d) Vulnerability finding, because port `8008` is open

### Question 20

**Scenario provenance only (not needed to answer):** Enterprise MacBook and media-device coexistence on conference-room networks.

A laptop advertises AirPlay, SSH on port 22, and mDNS host type `MacBookPro`. A separate rule prevents the Cast classifier from labeling Apple laptops as Google Cast devices even when media-sharing services exist.

Which classifier result follows?

(a) Google Cast device
(b) Hikvision camera
(c) Unknown embedded device with no platform hints
(d) Apple laptop/media endpoint, not Google Cast

### Question 21

**Scenario provenance only (not needed to answer):** Fingerbank-style public device-fingerprinting services.

An enrichment adapter receives an external fingerprint label `Dahua IP Camera` from DHCP option patterns. The local source contract treats external labels as interpreted evidence and requires raw source fields or adapter provenance to be retained with the label.

Which record is compliant?

(a) Label `Dahua IP Camera` plus adapter name, observed DHCP fields, and timestamp
(b) Label `Dahua IP Camera` with all raw fields removed
(c) Confirmed CVE list for Dahua cameras
(d) Password status for the camera

### Question 22

**Scenario provenance only (not needed to answer):** Public router DHCP lease-table examples.

A router table lists an IoT sensor hostname `axis-cam-lobby` and MAC OUI `Axis Communications`. Chapter 2 treats hostname and OUI as two different sources when they come from different collection paths, but the hostname can be user-assigned.

Which evidence interpretation is correct?

(a) The hostname alone confirms exact firmware
(b) The hostname is discarded because users can name devices
(c) Vendor Axis is supported by two source types; model and firmware remain unknown
(d) CVSS score can be computed from the hostname

### Question 23

**Scenario provenance only (not needed to answer):** Public IoT fleet-inventory incident reports.

An identity artifact for a warehouse scanner includes `vendor=Zebra`, `model=TC52`, `sources=[nmap,http,dhcp]`, `confidence=0.78`, and no timestamps. The source contract requires each evidence item to include collection time for later drift analysis.

Which defect exists in the record?

(a) It has too many sources
(b) Evidence timestamps are missing
(c) Confidence is below `1.00`
(d) The model field is forbidden in Chapter 2

### Question 24

**Scenario provenance only (not needed to answer):** Public TLS-stack fingerprinting research.

A factory HMI and an unrelated IoT camera share the same JARM hash because both use the same embedded TLS library. The rule says shared TLS-stack fingerprints can group endpoints but cannot identify product by themselves.

Which conclusion follows?

(a) Both devices are the same model
(b) The HMI is a camera
(c) The camera is an HMI
(d) The shared hash is a grouping signal requiring corroboration

### Question 25

**Scenario provenance only (not needed to answer):** Public camera ONVIF deployment guidance.

An ONVIF response says manufacturer `Hikvision`, model `DS-2CD2142FWD-I`, firmware `5.5.82`. The HTTP title says `Network Camera`. No conflicts exist. The CPE rule converts names to lowercase tokens, normalizes spaces to underscores, preserves hyphens in product tokens, and preserves firmware as the version token when present.

Which CPE candidate follows the rule?

(a) `cpe:2.3:a:hikvision:ds-2cd2142fwd-i:5.5.82:*:*:*:*:*:*:*`
(b) `cpe:2.3:a:network:camera:*:*:*:*:*:*:*:*`
(c) `cpe:2.3:a:hikvision:network_camera:*:*:*:*:*:*:*:*` with firmware deleted
(d) `cpe:2.3:o:microsoft:windows:5.5.82:*:*:*:*:*:*:*`

### Question 26

**Scenario provenance only (not needed to answer):** Public ONVIF device-management examples.

An IoT camera returns ONVIF manufacturer `Dahua` and model `IPC-HDW4431C-A`. A second HTTP title is `Camera Login`. The Chapter 2 rule gives structured ONVIF manufacturer and model precedence over generic titles.

Which identity state is correct?

(a) Vendor unknown, model `Camera Login`
(b) Vendor `Camera`, model `Login`
(c) Vendor Dahua, model `IPC-HDW4431C-A`, with ONVIF provenance
(d) No identity evidence because HTTP is generic

### Question 27

**Scenario provenance only (not needed to answer):** Public enterprise device-discovery workflows.

A scan report stores `identity.vendor=Axis` but does not store whether the value came from OUI, ONVIF, mDNS, HTTP, TLS, or operator input. Chapter 2 requires source provenance for every identity assertion.

Which remediation to the record model follows?

(a) Remove vendor fields from all identity records
(b) Add source, observed value, adapter, and timestamp fields for the vendor assertion
(c) Convert the vendor field into a CVE ID
(d) Replace all identity sources with one global confidence number

### Question 28

**Scenario provenance only (not needed to answer):** Smart-building SSDP device discovery.

An SSDP `friendlyName` is `Lobby Camera 3`, manufacturer is absent, and model is absent. Chapter 2 treats user-editable names as weak labels unless manufacturer or model fields corroborate them.

Which output is correct?

(a) Vendor `Lobby`, model `Camera 3`
(b) Exact CPE for the lobby camera
(c) Confirmed camera vulnerability
(d) User-editable name retained as weak evidence; vendor/model unresolved

### Question 29

**Scenario provenance only (not needed to answer):** Public DHCP vendor-class examples for embedded devices.

A DHCP record for an IoT gateway contains vendor class `udhcp 1.20.2` and hostname `gw-west`. No MAC OUI match, service banner, or structured protocol self-report is present. The Chapter 2 rule treats generic DHCP client software as insufficient for device vendor identity.

Which enrichment result follows?

(a) Hostname and DHCP client evidence retained; device vendor unresolved
(b) Vendor `udhcp`; model `1.20.2`
(c) Exact CPE for the gateway appliance
(d) CVE confirmed because `udhcp` has a version string

### Question 30

**Scenario provenance only (not needed to answer):** Public certificate reuse cases in embedded fleet deployments.

Twenty OT cameras from two vendors present the same TLS certificate subject `CN=IP Camera`. The local rule says a generic certificate subject shared across vendors has no vendor-level identity value.

Which evidence treatment follows?

(a) Assign every camera to one vendor
(b) Assign all cameras firmware version `IP Camera`
(c) Retain the certificate as TLS metadata but do not use it as vendor evidence
(d) Start exploitation testing because a certificate is reused

### Question 31

**Scenario provenance only (not needed to answer):** CISA guidance on asset visibility for operational environments.

An enrichment pipeline receives this host: `10.5.5.40`, ports `80` and `554`, OUI vendor `Hikvision`. The routing table says port `554` enables RTSP probing, and port `80` enables HTTP banner probing.

Which probe plan is consistent with the routing table?

(a) NVD lookup only
(b) HTTP banner plus RTSP probe, with OUI retained
(c) ONVIF only because every camera supports ONVIF
(d) No enrichment because OUI already exists

### Question 32

**Scenario provenance only (not needed to answer):** Public service inventory for warehouse handheld scanners.

A warehouse handheld exposes SSH on port 22 and HTTPS on port 443. Nmap reports `OpenSSH` and `nginx`; the HTTPS certificate says `CN=Zebra TC52 Enrollment`. The rule says generic infrastructure products are not the handheld model, but a vendor-bearing certificate subject can support identity.

Which result is correct?

(a) Model `OpenSSH`, vendor `nginx`
(b) Vendor unknown because SSH exists
(c) Exact firmware known from HTTPS
(d) Zebra TC52 identity evidence from certificate metadata, with service products retained separately

### Question 33

**Scenario provenance only (not needed to answer):** Public mDNS and SSDP coexistence in smart-home networks.

An IoT speaker advertises mDNS model `HomePod`, while SSDP XML says manufacturer `Sonos` and model `One`. The source contract says mutually incompatible vendor/model evidence must be recorded as a conflict.

Which artifact state follows?

(a) Conflict containing Apple/HomePod mDNS evidence and Sonos/One SSDP evidence
(b) Apple/HomePod only, because mDNS arrived first
(c) Sonos/One only, because XML is longer
(d) Unknown with all evidence removed

### Question 34

**Scenario provenance only (not needed to answer):** Public IP-camera fleet administration.

A camera has HTTP realm `IP Camera`, OUI `Hikvision`, and RTSP server `Hikvision Streaming Server`. The rule counts materially different evidence sources when they arise from different adapters and observed fields.

Which source count for Hikvision vendor evidence is correct?

(a) Zero, because HTTP realm is generic
(b) One, because all camera data is one source
(c) Two: OUI and RTSP
(d) Three: OUI, RTSP, and generic HTTP realm

### Question 35

**Scenario provenance only (not needed to answer):** NIST CPE Naming specification.

An IoT camera enrichment artifact has vendor `dahua`, model `ipc-hdw4431c-a`, and firmware `2.800.0000000.16.R`. The Chapter 2 handoff permits CPE candidates but does not decide CVE applicability.

Which handoff field is allowed?

(a) Confirmed exploited vulnerability list
(b) CPE candidate with vendor, product, version, and provenance
(c) Root-cause remediation plan
(d) Attack-path graph

### Question 36

**Scenario provenance only (not needed to answer):** Public embedded-device web interfaces.

An HTTP endpoint on an IoT DVR returns `401 Unauthorized` and `WWW-Authenticate: Basic realm="Dahua DVR"`. No credentials are tried. Chapter 2 treats authentication realm text as identity evidence, while credential testing is reserved for Chapter 3.

Which claim is correct?

(a) Default credentials failed
(b) Default credentials succeeded
(c) Vulnerability confirmed
(d) Dahua DVR identity evidence is present; credential status is unknown

### Question 37

**Scenario provenance only (not needed to answer):** Public operational network baseline monitoring.

A baseline has 100 IoT devices. Chapter 2 enrichment produces 64 records with vendor identity, 48 with model identity, and 20 with firmware identity. Identity coverage is defined as `records with any vendor identity / discovered hosts`.

Which value is correct?

(a) `64%`
(b) `48%`
(c) `20%`
(d) `132%`

### Question 38

**Scenario provenance only (not needed to answer):** Public hospital asset-management reporting.

A hospital scanner enrichment report has 40 discovered IoT hosts. Vendor evidence exists for 30 hosts; of those, 18 also have model evidence. Model precision among vendor-identified hosts is defined as `model-evidence hosts / vendor-evidence hosts`.

Which value is correct?

(a) `18%`
(b) `30%`
(c) `60%`
(d) `75%`

### Question 39

**Scenario provenance only (not needed to answer):** Public camera firmware-inventory practices.

A fleet has 25 Hikvision cameras. ONVIF reports firmware for 15 cameras, RTSP reports vendor only for 6, and OUI reports vendor only for 4. Firmware completeness is defined as `hosts with firmware evidence / hosts in fleet`.

Which value is correct?

(a) `24%`
(b) `60%`
(c) `76%`
(d) `100%`

### Question 40

**Scenario provenance only (not needed to answer):** Public smart-building inventory normalization.

Two enrichment adapters produce product strings `DS-2CD2142FWD-I` and `ds_2cd2142fwd_i`. The normalization rule lowercases and converts hyphen/underscore runs to single underscores.

Which normalized token is produced for both strings?

(a) `DS-2CD2142FWD-I`
(b) `ds-2cd2142fwd-i`
(c) `ds2cd2142fwdi`
(d) `ds_2cd2142fwd_i`

### Question 41

**Scenario provenance only (not needed to answer):** Public device-fingerprint collision examples.

A printer and a camera share the same favicon hash, but their OUIs, HTTP realms, and mDNS records disagree. The rule says one shared weak fingerprint cannot override three conflicting identity-bearing sources.

Which treatment follows?

(a) Merge the printer and camera into one product
(b) Delete the OUI, HTTP, and mDNS records
(c) Keep the favicon as weak grouping evidence and preserve the conflicts
(d) Confirm both devices share firmware

### Question 42

**Scenario provenance only (not needed to answer):** Public industrial switch administration guides.

An industrial switch exposes LLDP neighbor name `PLC-Line4`, HTTP title `Managed Switch`, and OUI vendor `Moxa`. Chapter 2 says neighbor names describe topology context, while OUI and service evidence describe endpoint identity.

Which artifact partition is correct?

(a) Endpoint vendor evidence: Moxa; topology context: PLC-Line4 neighbor name
(b) Endpoint model: PLC-Line4
(c) Firmware version: Managed Switch
(d) Vulnerability status: confirmed

### Question 43

**Scenario provenance only (not needed to answer):** Public campus IoT inventory tools.

An enrichment result has vendor `Yealink`, model `T46S`, confidence `0.82`, but no list of observed fields. The evidence contract requires reproducible identity claims to include observed source values.

Which added data satisfies the contract?

(a) A CVSS score
(b) A count of all hosts on the subnet
(c) A remediation due date
(d) Observed fields such as OUI prefix, HTTP realm, or mDNS service text

### Question 44

**Scenario provenance only (not needed to answer):** Public video-management system deployments.

A camera returns HTTP realm `Hikvision`, RTSP server `Hikvision Streaming Server`, and ONVIF manufacturer `Hikvision`. Chapter 2 says matching evidence from three adapter classes can raise confidence but cannot exceed the ceiling of the highest direct structured source, `0.85`, without manual verification.

Which confidence value violates the rule?

(a) `0.80`
(b) `0.97`
(c) `0.85`
(d) `0.75`

### Question 45

**Scenario provenance only (not needed to answer):** Public Nmap service-detection behavior.

Nmap reports `aiohttp 3.13.5 Python/3.11` on a lab camera simulator. The simulator also returns HTTP realm `Hikvision`. The Chapter 2 evidence rule says the web framework product identifies the simulator software stack, while the realm supplies emulated device identity.

Which separated interpretation is correct?

(a) Device vendor `aiohttp`, model `Python`
(b) Firmware version `3.13.5` for Hikvision hardware
(c) Service stack evidence: aiohttp/Python; device identity evidence: Hikvision realm
(d) No evidence because simulator stacks are forbidden

### Question 46

**Scenario provenance only (not needed to answer):** Public factory OT segmentation examples.

A scanner cannot reach an OT controller's port 80 because a firewall drops the packets. Chapter 1 passive telemetry still shows the controller on the network. Chapter 2 says failed enrichment does not erase discovery evidence.

Which record state follows?

(a) Host remains discovered; HTTP enrichment is unavailable from this vantage
(b) Host is deleted from inventory
(c) Device is confirmed patched
(d) Vendor is set to firewall

### Question 47

**Scenario provenance only (not needed to answer):** Public firmware naming practices in network cameras.

An IoT camera model field is `IPC-HDW4431C-A`, and firmware field is `V2.800.0000000.16.R`. The normalization rule removes a leading `V` from firmware versions but keeps internal dots and letters.

Which version token is correct?

(a) `v2_800_0000000_16_r`
(b) `2`
(c) `latest`
(d) `2.800.0000000.16.R`

### Question 48

**Scenario provenance only (not needed to answer):** Public OT asset-discovery data-quality reporting.

An enrichment pipeline produces 200 source observations and 80 identity artifacts. A deduplication rule says observations with the same host, adapter, observed field, and timestamp are duplicates. Ten observations are duplicates.

How many source observations remain after deduplication?

(a) `80`
(b) `190`
(c) `200`
(d) `210`

### Question 49

**Scenario provenance only (not needed to answer):** Public smart-city camera deployments.

An identity record has vendor `Hikvision`, model `DS-2CD`, firmware `unknown`, and CPE candidate with version wildcard. The handoff rule says Chapter 3 receives candidates plus uncertainty fields, not hidden assumptions.

Which handoff representation is correct?

(a) Exact firmware inferred from vendor release history
(b) Confirmed CVE list attached before lookup
(c) CPE candidate with wildcard version and an uncertainty note
(d) Device excluded because firmware is unknown

### Question 50

**Scenario provenance only (not needed to answer):** Public cybersecurity analytics pipeline designs for IoT/OT inventory.

Chapter 2 receives Chapter 1 host claims and emits enriched identity artifacts. Chapter 3 consumes identity artifacts for vulnerability assessment. A record contains only `ip`, `mac`, `open_ports`, `vendor`, `model`, `confidence`, `sources`, and `cpe_candidates`.

Which stage boundary classification is correct?

(a) Chapter 2 enrichment artifact ready for Chapter 3 input
(b) Chapter 3 confirmed weakness record
(c) Chapter 4 attack-path record
(d) Remediation ticket with owner and due date
