ISACA · IoT-Fund
Validates foundational knowledge of Internet of Things technology, covering IoT network components, sensors and actuators, middleware, physical security systems, data authentication and protection methods, and IoT architecture elements.
Practice Questions
630
≈ 4 practice exams
Duration
120 minutes
Passing Score
65%
Difficulty
FoundationalLast Updated
Feb 2026
Use this IoT-Fund practice exam to prepare for IoT Fundamentals Certificate with realistic questions, detailed explanations, and focused study modes. The practice bank includes 630 questions for ISACA IoT-Fund, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The ISACA IoT Fundamentals Certificate validates foundational knowledge of Internet of Things concepts and the technologies that enable IoT ecosystems. The exam assesses a candidate's understanding of IoT network architecture, the roles of sensors and actuators, middleware functionality, physical security systems, and data authentication and protection methods. It is part of ISACA's Certified in Emerging Technology (CET) Certification program, which encompasses four certificate exams — Cloud Computing Fundamentals, Blockchain Fundamentals, IoT Fundamentals, and AI Fundamentals — that together constitute the full CET credential.
The certification employs a hybrid assessment model, combining traditional knowledge-based multiple-choice questions with performance-based questions delivered in a live virtual lab environment. This approach ensures candidates can not only articulate IoT principles but also demonstrate practical skills in applying IoT technologies. The exam covers real-world IoT use cases across industries including healthcare, government, utilities, and enterprise operations, with particular emphasis on security risks and governance considerations.
The IoT Fundamentals Certificate is designed for individuals at the beginning of their IoT journey, including students, recent graduates, and career changers seeking to establish credibility in emerging technology domains. IT professionals looking to broaden their skills into IoT, as well as cybersecurity, risk, and audit professionals who need to evaluate IoT environments and their associated controls, are well-suited for this credential.
Technical and business analysts who bridge IoT technology with organizational strategy, consultants and solution architects advising on IoT implementations, and government or utility professionals working on smart infrastructure initiatives are also prime candidates. Because there are no prerequisites, the exam is accessible to anyone with a foundational interest in IoT, regardless of prior formal technology credentials.
ISACA imposes no formal prerequisites for the IoT Fundamentals Certificate. Candidates can register at any time without meeting prior educational or professional requirements, making it one of the most accessible entry points in ISACA's credentialing portfolio.
While no prior experience is required, candidates with a basic familiarity with networking concepts, general IT infrastructure, and cybersecurity principles will find the material more approachable. ISACA recommends using its official preparation resources — the self-guided online course, the lab package, and the study guide — to build the necessary foundational knowledge before attempting the exam.
The IoT Fundamentals exam consists of 60 questions delivered in a computer-based, remotely proctored format over a 2-hour time limit. Questions blend traditional knowledge-based multiple-choice items with performance-based questions set in a virtual lab environment, assessing both conceptual understanding and practical application. Candidates must achieve a passing score of 65% or higher.
The exam is administered online with continuous registration — there are no restricted testing windows. Exam eligibility is valid for 12 months from the date of registration, and appointments can be scheduled as early as 48 hours after payment. Candidates receive four total attempts within any rolling 12-month period. Rescheduling is permitted without penalty provided at least 48 hours' notice is given.
Earning the IoT Fundamentals Certificate signals to employers a verified, vendor-neutral understanding of IoT concepts validated by ISACA, a globally recognized IT governance and cybersecurity credentialing body. The certificate serves as a stepping stone toward ISACA's full Certified in Emerging Technology (CET) Certification, which requires passing all four CET-track exams (Cloud Computing, Blockchain, IoT, and AI Fundamentals) and submitting an application. Holding the CET designation positions professionals across roles such as IoT solution architect, cybersecurity analyst, IT risk consultant, technical analyst, and smart infrastructure engineer.
The IoT market continues to expand rapidly across sectors including industrial automation, healthcare, smart cities, and connected consumer devices, driving consistent enterprise demand for professionals who can evaluate IoT risk and governance. While salary data specific to this certificate is not published by ISACA, professionals who pair this credential with broader cybersecurity or cloud certifications — such as ISACA's CISM or CISA — report enhanced positioning for mid-to-senior roles in IT audit, risk management, and emerging technology advisory functions.
5 sample questions with answers and explanations. The full bank has 630 questions, enough for 4 full-length practice exams.
Preview — answers shown1. An IoT device manufacturer implements NISTIR 8259A IoT Device Cybersecurity Capability Core Baseline. The device must support remote configuration changes, provide unique device identification, and maintain awareness of its security state. Which three core capabilities must the device implement? (Select three!)
Multiple correct answersExplanation
Device Identification is a core NISTIR 8259A capability requiring logical identifiers like serial numbers and MAC addresses plus physical identifiers for device tracking. Device Configuration is a core capability that enables authorized configuration changes through secure interfaces. Cybersecurity State Awareness is a core capability allowing devices to report their security state, installed software versions, and configuration status. These three are explicitly listed among the six core baseline capabilities. Physical tamper detection is a physical hardening technique recommended by OWASP IoT Top 10 but is not one of the six NISTIR 8259A core baseline capabilities. Blockchain-based supply chain verification is an emerging technology for provenance but not a required core baseline capability. Biometric authentication relates to logical access control which is covered by the broader Logical Access core capability but is not itself a standalone core capability requirement.
2. An IoT platform uses MQTT persistent sessions with cleanSession flag set to 0. What happens when a client reconnects after network failure? (Select one!)
Explanation
MQTT persistent sessions created with cleanSession flag set to 0 preserve subscriptions and queue unacknowledged QoS 1 messages during disconnection. Upon reconnection, the broker restores all saved subscriptions and delivers stored messages. The sessionPresent flag in CONNACK confirms session restoration. With cleanSession set to 1, subscriptions would be lost. QoS 2 is not universally supported by all brokers. Session expiration depends on configured timeout period, not immediate expiration.
3. A data center implements COBIT 2019 framework for IoT governance. The IT steering committee must ensure IoT investments align with business objectives and manage enterprise risks. Which COBIT 2019 domain and core principle apply to this oversight function? (Select one!)
Explanation
EDM (Evaluate, Direct, Monitor) domain with Provide Stakeholder Value principle is correct because EDM specifically addresses governance (not management) and the oversight role of ensuring alignment with business objectives. The steering committee evaluates options, directs resources, and monitors outcomes - precisely the EDM function. Provide Stakeholder Value is the first core principle ensuring IT investments deliver business benefits. BAI focuses on solution implementation, not governance oversight. DSS handles operational service delivery. MEA involves performance measurement and compliance monitoring but lacks the directive authority of EDM. Dynamic Governance refers to adapting the governance system, not the primary stakeholder value alignment function described.
4. A transportation authority implements LoRaWAN for parking sensors across a city. The network uses OTAA (Over-the-Air Activation) instead of ABP (Activation by Personalization) for device provisioning. Which three security advantages does OTAA provide compared to ABP? (Select three!)
Multiple correct answersExplanation
OTAA (Over-the-Air Activation) provides superior security by generating unique NwkSKey (Network Session Key) and AppSKey (Application Session Key) for each device activation using the join procedure, preventing the use of static keys across devices. OTAA provides dynamic key generation during each join, preventing replay attacks because old session keys become invalid after rejoining. OTAA enables devices to rejoin the network with fresh session keys after connectivity issues or network changes, improving security and flexibility. OTAA does not eliminate encryption; it enhances it through dynamic keys. ABP (Activation by Personalization) uses pre-configured static keys, not OTAA. OTAA adds join latency of several seconds compared to ABP, but this trade-off provides significantly better security for production deployments.
5. A retail chain deploys 10,000 BLE beacons using GATT for proximity marketing. The beacons advertise on channels 37, 38, and 39. Mobile apps must discover beacons and read product information stored in characteristics. Which BLE profile and advertising channel count are being used? (Select one!)
Explanation
GAP (Generic Access Profile) with 3 advertising channels is correct because GAP handles device discovery, connection establishment, and advertising on the three dedicated advertising channels (37, 38, 39). While GATT is used after connection for reading characteristics, GAP manages the initial beacon discovery phase. BLE has exactly 3 advertising channels and 37 data channels (total 40). GATT profile manages data exchange structure after connection but does not handle advertising or discovery. ATT (Attribute Protocol) is the lower-level protocol used by GATT for data transfer, not device discovery. L2CAP is a lower layer protocol that provides channel multiplexing but does not manage advertising or device discovery functions.
Data Science Fundamentals Certificate
DataSci-Fund · 591 questions
Digital Trust Ecosystem Framework Foundation Certificate
Digital-Trust · 600 questions
Information Technology Certified Associate (ITCA)
ITCA · 596 questions
IT Audit Fundamentals Certificate
IT-Audit-Fund · 627 questions
IT Risk Fundamentals Certificate
Risk-Fund · 616 questions
ISACA Advanced in AI Audit (AAIA)
AAIA · 600 questions
$17.99
One-time access to this exam