IoT Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is investigating a smart lock incident and has the homeowner's iPhone with the lock's companion app installed. The app stores data in an encrypted database. Which approach would be most effective to access the app's data?

   • ACapture the iPhone's network traffic while the app is in use.
   • BUse iTunes backup and restore the app data to another device.
   • CPerform a full file system extraction of the iPhone and use forensic tools to decrypt the app's database with the user's passcode.
   • DAsk the user to log into the app and export the data manually.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An investigator needs to acquire data from a smart lock that is still powered on and connected to the home Wi-Fi. The lock has a small amount of volatile memory that may contain recent access codes. Which acquisition strategy best balances the need to preserve volatile data and maintain chain of custody?

   • AImmediately power off the lock and remove its battery to preserve non-volatile memory.
   • BPerform a live acquisition over the network using the vendor's debug interface, documenting each command.
   • CDisconnect the lock from Wi-Fi and then image its flash memory.
   • DWait for the lock to enter a low-power state and then perform a physical acquisition.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a potential evidence source in an IoT ecosystem?

   • AThe device's user manual
   • BThe user's electricity bill
   • CThe device's cardboard packaging
   • DThe companion mobile app installed on the user's smartphone
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic examiner needs to extract data from a smart home companion app on an Android phone. The app communicates with a cloud backend. Which method would yield the most comprehensive forensic data from the app?

   • APerform a logical extraction of the phone and parse the app's sandboxed databases and shared preferences.
   • BUse a cloud extraction tool to pull the app's backup from the vendor's servers.
   • CCapture the app's network traffic and decrypt it using the phone's VPN keys.
   • DUninstall the app and reinstall it to capture the initial setup traffic.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic investigator is examining a smart camera system where video clips are stored in the vendor's cloud and also cached on the camera's SD card. The vendor's cloud is in a jurisdiction with strict data privacy laws. The investigator needs to preserve evidence without violating privacy regulations. Which action is most appropriate?

   • ASecure the SD card and issue a legal preservation request to the vendor for the cloud data.
   • BOnly analyze the SD card and ignore the cloud data to avoid legal complications.
   • CAsk the vendor to delete the cloud data to comply with privacy regulations.
   • DDownload all cloud data using the owner's credentials without a warrant.
   Reveal Solution Discussion Select an answer first