IoT Forensics CHFI Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary focus of IoT forensics as a discipline?

   • ARecovering deleted files from traditional hard drives and solid-state drives
   • BInvestigating cybercrimes that involve internet-connected physical devices and their ecosystems
   • CMonitoring network traffic for intrusion detection in enterprise environments
   • DAnalyzing only the cloud servers that store data from smart devices
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A forensic analyst is investigating a smart speaker that reportedly sent audio recordings to an unknown server. The analyst has access to the home router's traffic logs. Which network artifact would be most useful to confirm the data exfiltration?

   • AThe speaker's MAC address appearing in the DHCP logs.
   • BOutbound connections from the speaker's IP address to a non-standard port on a foreign server.
   • CThe router's firmware version and uptime.
   • DThe speaker's SSID and Wi-Fi password.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   An investigator is working on a case involving a smart fitness tracker that syncs data to a cloud service. The user is a citizen of a country with strict data protection laws. The investigator needs to obtain the cloud data for the investigation. Which consideration is most critical when planning the data acquisition?

   • AAsk the cloud provider to send the data to the investigator's personal email address.
   • BIgnore the cloud data and rely only on the fitness tracker's local storage.
   • CEnsure that the request for cloud data complies with the data protection laws of the user's country, including any requirements for international data transfers.
   • DUse the user's login credentials to access the cloud account directly, as this is the fastest method.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A forensic team is investigating a data breach involving a fleet of smart meters. The team needs to collect evidence from multiple devices, some of which are in remote locations and owned by third parties. The investigation must comply with legal requirements and maintain chain of custody. Which approach best addresses these constraints?

   • ARemotely access the meters using the vendor's backdoor credentials to acquire data quickly without alerting the owners.
   • BAsk the vendor to provide a full backup of all meter data from their cloud platform, assuming the data is accessible.
   • CCoordinate with the device owners and obtain legal authorization before remotely acquiring data from each meter, documenting every step in a chain-of-custody log.
   • DPhysically seize all meters without prior notice to preserve evidence and prevent tampering.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An analyst is examining a compromised smart light bulb that is part of a botnet. The bulb's firmware is stored on an external SPI flash chip. Which technique would be most appropriate to extract the firmware for analysis?

   • ADesolder the SPI flash chip and read it using a dedicated flash programmer.
   • BConnect to the bulb's debug UART port and issue a firmware dump command.
   • CUse the bulb's mobile app to export the firmware version.
   • DPerform a network capture and reassemble the firmware from OTA update traffic.
   Reveal Solution Discussion Select an answer first