IoT Forensics CHFI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic examiner is investigating a case where a smart scale is suspected of leaking health data to a third party. The scale is controlled by a mobile app. The examiner has the user's phone. Which mobile app data is most likely to reveal the data leak?

   • AThe app's network traffic logs, which may show data being sent to unexpected servers.
   • BThe app's user interface settings, which may show the user's preferences.
   • CThe app's cached images, which may contain screenshots of the data.
   • DThe phone's contact list, which may show who the data was shared with.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An examiner is trying to acquire data from a smart TV that is no longer booting. The TV's storage is an eMMC chip. Which acquisition method is most appropriate in this situation?

   • ARemove the eMMC chip and place it in a USB adapter to read it as a removable drive.
   • BPerform a chip-off acquisition by desoldering the eMMC chip and reading it with a programmer.
   • CConnect to the TV's network port and use a remote acquisition tool.
   • DUse the TV's USB port to boot a forensic live CD and image the storage.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic examiner is investigating a case where a smart doorbell is suspected of capturing video of a package theft. The doorbell has local storage and also syncs to a cloud service. The examiner wants to find the video evidence. Which evidence source is most likely to contain the video footage?

   • AThe doorbell's local storage, which may contain the video clips recorded at the time of the theft.
   • BThe user's smartphone, which may have a notification but not the full video.
   • CThe Wi-Fi router's logs, which may show when the doorbell uploaded data.
   • DThe doorbell's power supply, which may have a backup battery that stores data.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An investigator is examining a smart lock that is controlled via a cloud service. The investigator needs to determine who unlocked the door at a specific time. Which data source is most likely to provide the answer?

   • AThe smart lock's internal memory, which may store only the last few events.
   • BThe Wi-Fi router's logs, which may show when the lock communicated with the cloud.
   • CThe cloud service's access logs, which record the time and user account that sent the unlock command.
   • DThe user's smartphone, which may have a notification of the unlock event.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a burglary investigation, law enforcement seizes a smart home hub, several smart bulbs, a smart door lock, and the homeowner's smartphone. The hub is a proprietary device with no removable storage, and the bulbs are simple Wi-Fi devices. The smartphone has a companion app for the hub. Which approach best prioritizes forensic evidence collection from these devices?

   • ASeize only the hub and smartphone, as the bulbs and lock are peripheral devices with no evidentiary value.
   • BImage the hub's flash memory, extract the smartphone app's local database, and capture the Wi-Fi router's logs.
   • CDisassemble the smart bulbs and attempt to extract data from their internal EEPROM chips.
   • DFocus only on the smartphone because the companion app contains all configuration and event data.
   Reveal Solution Discussion Select an answer first