IoT Forensics CHFI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During an investigation, an examiner finds a small, embedded device with no visible brand or model number. The device has a microcontroller, a wireless radio, and a flash memory chip. The examiner needs to identify the device and its potential evidentiary value. Which approach is most effective for classifying the device and planning the forensic acquisition?

   • AUse a JTAG interface to read the firmware directly from the flash chip without needing to identify the device.
   • BRun a network scan to see what protocols the device uses, and infer its type from the traffic.
   • CAsk the owner what the device is, since they would know its purpose and model.
   • DSearch the device's FCC ID and any printed logos, then research the chipset and datasheets to determine the device's functionality and communication protocols.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An investigator is collecting evidence from a smart TV in a criminal case. The TV is still powered on and showing a live stream. Which step should be taken FIRST to preserve evidence?

   • APhotograph the screen and the TV's connections, then unplug the TV from power.
   • BImmediately unplug the TV to prevent any remote wipe.
   • CUse the TV's remote to navigate to the settings menu and check the network status.
   • DConnect a forensic write-blocker to the TV's USB port and image the internal storage.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is responding to a worm that is spreading across IoT devices in a hospital. The worm exploits a vulnerability in a specific firmware version. The team has identified the vulnerability and has a patch available. However, patching all devices would require downtime for critical medical equipment. Which action best balances security and operational needs?

   • AIgnore the worm because it is only affecting IoT devices and not the main hospital network.
   • BSegment the network to isolate vulnerable devices, apply the patch to non-critical devices first, and schedule downtime for critical devices.
   • CDisconnect all IoT devices from the network until the worm is contained.
   • DApply the patch to all devices immediately, including critical medical equipment, to stop the worm.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic examiner is investigating a case involving a smart light bulb that is controlled by a mobile app. The examiner has access to the user's smartphone. Which data from the mobile app is most likely to provide evidence of the light bulb's usage history?

   • AThe app's cached images and icons.
   • BThe smartphone's call logs and contacts.
   • CThe app's local database, which may contain event logs, timestamps, and device settings.
   • DThe smartphone's GPS location history.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A forensic investigator is handling a case involving a smart doorbell that stores video clips in the vendor's cloud. The user's account is in the United States, but the vendor's servers are in the EU. The investigation requires obtaining video evidence, but the vendor's legal team cites GDPR restrictions on data transfer. Which action best addresses the legal and forensic requirements?

   • AObtain a court order or user consent and request the vendor to preserve and export the relevant clips from the EU region.
   • BAbandon the cloud evidence and rely solely on the doorbell's local storage.
   • CRemotely access the user's account and download the clips without notifying the vendor.
   • DRequest the vendor to delete the clips to comply with GDPR and avoid legal complications.
   Reveal Solution Discussion Select an answer first