An examiner is faced with a variety of IoT devices in a crime scene, including a smart watch, a Wi-Fi router, and a baby monitor. The examiner needs to prioritize which devices to acquire first. Which factor should be the primary consideration for prioritization?

The volatility of the data on each device, with volatile data being acquired first.

The brand of the device, with more popular brands being acquired first.

The number of devices, with acquiring more devices first being better.

The physical size of the device, with smaller devices being easier to acquire.

Which of the following is a common indicator of compromise (IoC) for an IoT device?

The device's physical temperature

Unusual outbound network connections to unknown IP addresses

The device's LED color changing

When classifying an IoT device for forensic analysis, which component is most relevant to identify?

The microcontroller or system-on-chip (SoC) model

The color and physical dimensions of the device

Which step is part of a structured forensic process for IoT devices?

Updating the device firmware to the latest version

Immediately powering off the device to stop data collection

Resetting the device to factory defaults

Preserving the device's state by isolating it from network access

What is the purpose of using a hardware debug interface like JTAG in IoT forensics?

To connect the device to a Wi-Fi network

To access the device's memory and debugging functions

To update the device's firmware

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 2

IoT Forensics CHFI Practice Questions (Page 6)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

56questions here

12free pages

11concepts

Questions 26–30

26application · medium
An examiner is faced with a variety of IoT devices in a crime scene, including a smart watch, a Wi-Fi router, and a baby monitor. The examiner needs to prioritize which devices to acquire first. Which factor should be the primary consideration for prioritization?
Select an answer first
27foundation · easy
Which of the following is a common indicator of compromise (IoC) for an IoT device?
Select an answer first
28foundation · easy
When classifying an IoT device for forensic analysis, which component is most relevant to identify?
Select an answer first
29foundation · easy
Which step is part of a structured forensic process for IoT devices?
Select an answer first
30foundation · easy
What is the purpose of using a hardware debug interface like JTAG in IoT forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.