IoT Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What type of evidence can be extracted from IoT network traffic?

   • AThe user's biometric data
   • BThe device's physical location via GPS
   • CThe device's firmware version
   • DIP addresses and communication timestamps
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic team is investigating a ransomware attack on a smart building's HVAC system. The team has identified several IoT devices that may be compromised. The team needs to preserve evidence while maintaining the building's operations. Which approach best balances the need for evidence preservation and operational continuity?

   • AIsolate the compromised devices from the network while keeping them powered on, and perform live acquisition of their volatile data.
   • BReplace the compromised devices with new ones and send the old devices to a lab for analysis.
   • CPower off the devices immediately to stop the ransomware and preserve non-volatile storage.
   • DLeave the devices running and connected to the network to monitor the ransomware's behavior.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An investigator is examining a suspected IoT botnet infection on a smart thermostat. The device communicates with a remote command-and-control server. Which network forensic technique would most effectively reveal the C2 communication pattern and any data exfiltration?

   • ARun a port scan against the thermostat to identify open ports and services.
   • BPerform a full packet capture and decrypt all TLS traffic using the thermostat's private key.
   • CCapture and analyze traffic at the home router's mirror port, focusing on DNS queries and TLS handshake metadata.
   • DAnalyze only the thermostat's firmware to identify embedded C2 domains.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key characteristic of edge computing that affects IoT forensics?

   • AEdge devices are always cloud-based
   • BData processing occurs near the device rather than solely in the cloud
   • CEdge computing eliminates the need for network forensics
   • DEdge devices do not store any data
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An investigator is analyzing a smart camera that was used in a cyberstalking case. The camera's firmware is encrypted, and the investigator needs to analyze it for potential backdoors. Which technique would be most appropriate to begin the firmware analysis?

   • ARun the firmware in an emulator to observe its behavior.
   • BAttempt to identify the encryption algorithm and search for the decryption key in the device's bootloader.
   • CUse a hex editor to search for plaintext strings in the encrypted firmware.
   • DPerform a static analysis of the encrypted firmware binary.
   Reveal Solution Discussion Select an answer first