A forensic investigator is examining a smart home ecosystem after a suspected intrusion. Which of the following are potential evidence sources that should be considered? (Select all that apply.)

The Wi-Fi router's DHCP lease logs.

The smart hub's internal event log.

The homeowner's smartphone companion app data.

The smart bulbs' individual MAC addresses.

The vendor's cloud account activity logs.

A security analyst is analyzing a malware sample found on a smart thermostat. The malware communicates with a C2 server using DNS tunneling. Which technique would be most effective to detect this activity in network traffic?

Disable the thermostat's network access to stop the malware.

Inspect the thermostat's firmware for hardcoded C2 IP addresses.

Monitor DNS queries for unusual domain names and high query volume from the thermostat.

Run a full packet capture and decrypt all DNS traffic.

Which technique is used to analyze the firmware of an IoT device?

Observing the device's LED patterns

Extracting the firmware image and examining its file system

Measuring the device's power consumption

Which of the following is an example of an IoT device category that a forensic investigator might classify?

Traditional landline telephones

A forensic investigator is collecting evidence from a smart home hub that is part of a legal case. The hub is connected to the internet and the investigator wants to prevent remote tampering. Which action should be taken to secure the device?

Update the hub's firmware to the latest version.

Disconnect the hub from the network and place it in a Faraday bag.

Leave the hub connected to the network to preserve cloud sync data.

Power off the hub and remove its battery.

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 2

IoT Forensics CHFI Practice Questions (Page 11)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

56questions here

12free pages

11concepts

Questions 51–55

51application · medium · select all that apply
A forensic investigator is examining a smart home ecosystem after a suspected intrusion. Which of the following are potential evidence sources that should be considered? (Select all that apply.)
Select an answer first
52application · medium
A security analyst is analyzing a malware sample found on a smart thermostat. The malware communicates with a C2 server using DNS tunneling. Which technique would be most effective to detect this activity in network traffic?
Select an answer first
53foundation · easy
Which technique is used to analyze the firmware of an IoT device?
Select an answer first
54foundation · easy
Which of the following is an example of an IoT device category that a forensic investigator might classify?
Select an answer first
55application · medium
A forensic investigator is collecting evidence from a smart home hub that is part of a legal case. The hub is connected to the internet and the investigator wants to prevent remote tampering. Which action should be taken to secure the device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.