A security team is analyzing a malware infection on a smart thermostat. The malware appears to be a new variant of a known IoT botnet. The team has a memory dump from the device and a packet capture of its network traffic. Which analysis approach would be most effective in identifying the malware's capabilities and the attack vector?

Run the memory dump through an antivirus scanner to identify the malware family.

Perform memory forensics to extract the malware binary and strings, and correlate the network traffic with the malware's communication patterns.

Flash the device with the original firmware to remove the malware and then monitor for reinfection.

Analyze the packet capture for unusual DNS queries and block the domains.

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 2

IoT Forensics CHFI Practice Questions (Page 12)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

56questions here

12free pages

11concepts

Questions 56–56

56expert · hard
A security team is analyzing a malware infection on a smart thermostat. The malware appears to be a new variant of a known IoT botnet. The team has a memory dump from the device and a packet capture of its network traffic. Which analysis approach would be most effective in identifying the malware's capabilities and the attack vector?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

IoT Forensics CHFI Practice Questions (Page 12)

Questions 56–56

Keep studying — Mobile and IoT Forensics