IoT Forensics CHFI Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of maintaining a chain of custody in an IoT forensic investigation?

   • ATo identify the manufacturer of the IoT device
   • BTo reduce the cost of the investigation
   • CTo ensure the integrity and admissibility of evidence in court
   • DTo speed up the forensic analysis process
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a Mirai-like botnet infection on a fleet of IP cameras. The cameras have limited storage and no forensic tooling. The analyst has network captures from the corporate firewall. Which approach would most reliably identify compromised cameras and the attack vector?

   • AIsolate all cameras from the network and assume they are all compromised.
   • BCorrelate firewall logs with known C2 domains and analyze outbound connection patterns from each camera's IP address.
   • CRun vulnerability scans against all cameras to identify open telnet ports.
   • DPhysically image every camera's flash memory to search for malware binaries.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An investigator is examining a smart car's infotainment system. The car is connected to the manufacturer's cloud service, and the investigator needs to acquire data from both the car's local storage and the cloud. The car is currently in a different jurisdiction than the cloud servers. Which approach is most appropriate to ensure the evidence is admissible?

   • AAcquire the local storage first and then access the cloud using the car owner's credentials.
   • BAsk the manufacturer to provide the cloud data without a legal request, as they are the data controller.
   • COnly acquire the local storage and ignore the cloud data to avoid legal complications.
   • DObtain legal authorization for both the local acquisition and the cloud data request, ensuring compliance with the laws of both jurisdictions.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In IoT cloud forensics, what is the primary challenge when acquiring data from a cloud service provider?

   • ACloud data is automatically deleted after 24 hours
   • BCloud data is always encrypted and cannot be decrypted
   • CData may reside in multiple jurisdictions with different legal frameworks
   • DCloud providers do not store any data from IoT devices
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is monitoring a smart factory's network. The analyst notices that a particular IoT sensor is sending data to an unusual IP address on a non-standard port. The sensor is supposed to send data only to the local SCADA system. What should the analyst do first?

   • ACapture and analyze the network traffic to determine if the sensor is compromised and what data is being sent.
   • BIgnore the traffic because it might be a legitimate firmware update.
   • CBlock the unusual IP address at the firewall immediately.
   • DDisconnect the sensor from the network to prevent further data loss.
   Reveal Solution Discussion Select an answer first