ISACA • IoT-Fund
Validates foundational knowledge of Internet of Things technology, covering IoT network components, sensors and actuators, middleware, physical security systems, data authentication and protection methods, and IoT architecture elements.
Questions
630
Duration
120 minutes
Passing Score
65%
Difficulty
FoundationalLast Updated
Feb 2026
The ISACA IoT Fundamentals Certificate validates foundational knowledge of Internet of Things concepts and the technologies that enable IoT ecosystems. The exam assesses a candidate's understanding of IoT network architecture, the roles of sensors and actuators, middleware functionality, physical security systems, and data authentication and protection methods. It is part of ISACA's Certified in Emerging Technology (CET) Certification program, which encompasses four certificate exams — Cloud Computing Fundamentals, Blockchain Fundamentals, IoT Fundamentals, and AI Fundamentals — that together constitute the full CET credential.
The certification employs a hybrid assessment model, combining traditional knowledge-based multiple-choice questions with performance-based questions delivered in a live virtual lab environment. This approach ensures candidates can not only articulate IoT principles but also demonstrate practical skills in applying IoT technologies. The exam covers real-world IoT use cases across industries including healthcare, government, utilities, and enterprise operations, with particular emphasis on security risks and governance considerations.
The IoT Fundamentals Certificate is designed for individuals at the beginning of their IoT journey, including students, recent graduates, and career changers seeking to establish credibility in emerging technology domains. IT professionals looking to broaden their skills into IoT, as well as cybersecurity, risk, and audit professionals who need to evaluate IoT environments and their associated controls, are well-suited for this credential.
Technical and business analysts who bridge IoT technology with organizational strategy, consultants and solution architects advising on IoT implementations, and government or utility professionals working on smart infrastructure initiatives are also prime candidates. Because there are no prerequisites, the exam is accessible to anyone with a foundational interest in IoT, regardless of prior formal technology credentials.
ISACA imposes no formal prerequisites for the IoT Fundamentals Certificate. Candidates can register at any time without meeting prior educational or professional requirements, making it one of the most accessible entry points in ISACA's credentialing portfolio.
While no prior experience is required, candidates with a basic familiarity with networking concepts, general IT infrastructure, and cybersecurity principles will find the material more approachable. ISACA recommends using its official preparation resources — the self-guided online course, the lab package, and the study guide — to build the necessary foundational knowledge before attempting the exam.
The IoT Fundamentals exam consists of 60 questions delivered in a computer-based, remotely proctored format over a 2-hour time limit. Questions blend traditional knowledge-based multiple-choice items with performance-based questions set in a virtual lab environment, assessing both conceptual understanding and practical application. Candidates must achieve a passing score of 65% or higher.
The exam is administered online with continuous registration — there are no restricted testing windows. Exam eligibility is valid for 12 months from the date of registration, and appointments can be scheduled as early as 48 hours after payment. Candidates receive four total attempts within any rolling 12-month period. Rescheduling is permitted without penalty provided at least 48 hours' notice is given.
Earning the IoT Fundamentals Certificate signals to employers a verified, vendor-neutral understanding of IoT concepts validated by ISACA, a globally recognized IT governance and cybersecurity credentialing body. The certificate serves as a stepping stone toward ISACA's full Certified in Emerging Technology (CET) Certification, which requires passing all four CET-track exams (Cloud Computing, Blockchain, IoT, and AI Fundamentals) and submitting an application. Holding the CET designation positions professionals across roles such as IoT solution architect, cybersecurity analyst, IT risk consultant, technical analyst, and smart infrastructure engineer.
The IoT market continues to expand rapidly across sectors including industrial automation, healthcare, smart cities, and connected consumer devices, driving consistent enterprise demand for professionals who can evaluate IoT risk and governance. While salary data specific to this certificate is not published by ISACA, professionals who pair this credential with broader cybersecurity or cloud certifications — such as ISACA's CISM or CISA — report enhanced positioning for mid-to-senior roles in IT audit, risk management, and emerging technology advisory functions.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 630 questions.
1. A research facility implements the IEEE P2413 standard for IoT system interoperability across multiple domains including healthcare monitoring and building automation. The standard defines a principle of Quadruple Trust. Which four elements comprise Quadruple Trust? (Select one!)
Explanation
IEEE P2413 standard defines Quadruple Trust as Protection, Security, Privacy, and Safety. Protection encompasses safeguarding assets and resources. Security addresses cyber threats and vulnerabilities. Privacy ensures personal data handling complies with regulations. Safety focuses on preventing physical harm to people and property. This holistic approach recognizes that IoT systems must address not only cybersecurity but also physical safety, data privacy, and asset protection across diverse domains. Authentication/Authorization/Accounting/Audit represent AAA framework. Confidentiality/Integrity/Availability form the CIA triad. Prevention/Detection/Response/Recovery represent incident management phases. Understanding Quadruple Trust is essential for designing comprehensive IoT security architectures.
2. An IoT security architect implements defense-in-depth for a smart building system. The architect needs to apply physical security hardening to prevent unauthorized access to device internals. Which three measures should be implemented? (Select three!)
Multiple correct answersExplanation
Physical security hardening includes disabling debug interfaces (JTAG/UART) to prevent hardware-level attacks, implementing tamper-evident enclosures to detect physical access attempts, and using tamper detection circuits that erase sensitive data like cryptographic keys when physical intrusion is detected. These measures address OWASP IoT Top 10 vulnerability number 10 (Lack of Physical Hardening). Firewall rules and IDS are network security measures, not physical hardening. Secure boot is firmware security rather than physical protection, though it complements physical measures.
3. An IoT device manufacturer implements secure boot using UEFI. During the boot process, the firmware must verify each component before execution. Which security mechanism provides the immutable hardware-based identity and cryptographic key storage foundation for this chain of trust? (Select one!)
Explanation
Trusted Platform Module 2.0 provides hardware-based root of trust with tamper-resistant storage for cryptographic keys and platform integrity measurements using Platform Configuration Registers. TPM enables secure boot by storing keys in hardware and verifying the boot chain. Software-based key storage in flash memory is vulnerable to extraction and tampering. BIOS passwords provide access control but not cryptographic verification of boot components. Operating system firewalls operate after boot completes and do not secure the boot process itself.
4. A pharmaceutical manufacturer implements IoT sensors in temperature-controlled storage facilities. Regulations require 99.99% uptime and the ability to continue operations during internet outages. Real-time alerts must trigger within 100 milliseconds if temperature exceeds thresholds. Which computing paradigm should the architect implement for temperature monitoring decisions? (Select one!)
Explanation
Edge computing processes data locally at the sensor or gateway level, providing microsecond-to-millisecond latency required for 100 millisecond alerts and enabling continued operation during internet outages since decisions are made locally. Edge devices can trigger alerts and control systems independently of cloud connectivity. Cloud computing requires internet connectivity and introduces seconds to minutes of latency. Fog computing operates at LAN level which may not achieve the required 100 millisecond response time. Hybrid computing does not specifically address the offline operation and latency requirements.
5. An IoT device development team must select between Contiki and RIOT OS for memory-constrained sensor nodes. Both are tested operating systems in the ISACA IoT Fundamentals exam. What distinguishes these IoT-specific operating systems from general-purpose systems like Ubuntu or Fedora? (Select one!)
Explanation
Contiki and RIOT OS are specifically designed as lightweight, open-source operating systems for networked, memory-constrained IoT devices, operating with kilobytes of RAM rather than gigabytes. These IoT-specific systems provide essential networking stacks (IPv6, 6LoWPAN, RPL, CoAP), real-time capabilities, and modular architectures optimized for sensors and actuators. General-purpose operating systems like Ubuntu or Fedora require substantial resources (typically 1GB+ RAM, multi-core processors) and include features unnecessary for constrained IoT devices. IoT operating systems are headless without graphical interfaces. They run on various microcontroller platforms beyond Arduino. The key distinction is optimization for resource-constrained, networked embedded systems rather than general computing.
One-time access to this exam