IoT Forensics CHFI Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic investigator is examining a smart home hub that controls various devices. The hub has been compromised, and the investigator needs to understand the scope of the compromise. Which evidence source is most likely to provide a comprehensive view of the devices that were affected?

   • AThe hub's event logs, which record commands sent to and received from each connected device.
   • BThe network traffic from a single device, which shows only that device's communications.
   • CThe user's mobile app, which may show only the user's manual commands.
   • DThe individual device's internal storage, which may contain only local data.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An investigator is examining a smart home system where the primary data is stored in the vendor's cloud service. The user's devices are in a different country than the cloud servers. The investigation requires obtaining the cloud data while respecting data residency laws. Which action is most appropriate?

   • AAsk the user to export the data from the cloud service and provide it to the investigator.
   • BRequest the data from the vendor through a legal process, specifying the region where the data is stored and ensuring compliance with local data protection regulations.
   • CIgnore the cloud data and rely only on the local device storage.
   • DLog into the user's cloud account with their credentials and download the data directly.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A forensic team is investigating a fatal fire in a smart home. The homeowner's smart smoke detector and smart thermostat may have recorded relevant data. The devices are cloud-connected and the vendor's servers are in a different country. Which challenge is MOST critical to address first?

   • AAnalyzing the devices' firmware for potential tampering.
   • BPreserving the devices' local storage by freezing them.
   • CEstablishing legal authority to access the cloud data across international borders.
   • DDetermining the exact make and model of the devices.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which characteristic of IoT devices presents a unique challenge for forensic investigators compared to traditional computers?

   • AThey are not connected to any network
   • BThey often have limited or no built-in storage for persistent data
   • CThey cannot be powered off without losing all data
   • DThey always run the same operating system as desktop computers
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic investigator is examining a suspected unauthorized access to a smart home network. The homeowner reports that a smart TV, a Wi-Fi thermostat, and a smart doorbell were all accessed remotely without permission. The investigator needs to identify which device was the initial entry point. Given the diversity of devices, what is the most appropriate first step to determine the attack origin?

   • AImmediately disconnect all devices from the network and image each device's non-volatile storage in a forensic lab.
   • BInterview the homeowner to determine which device they believe was compromised first.
   • CAcquire the volatile memory from each device and perform memory forensics to find the attacker's commands.
   • DCollect and analyze network traffic logs from the home router and any associated cloud accounts to correlate device activity and identify the initial compromise.
   Reveal Solution Discussion Select an answer first