Common IoT Attacks (Mirai, BrickerBot, Sybil, Blackhole) ISE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the most likely consequence of a blackhole attack on an IoT network?

   • AThe network is flooded with high volumes of traffic from many compromised devices
   • BPackets are silently discarded, causing data loss and broken communication paths
   • CDevices are permanently disabled by firmware corruption
   • DAll devices in the network are forced to use weak encryption keys
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst notices a sudden spike in outbound traffic from a fleet of IP cameras that were configured with the vendor's default admin password. The cameras are now part of a botnet launching a DDoS attack. Which immediate remediation step would most effectively stop the cameras from participating in the attack while preserving their functionality?

   • AReboot all cameras to clear the malware from memory.
   • BChange the default credentials on every camera and block outbound traffic on the attack port at the firewall.
   • CApply the latest firmware patch to all cameras.
   • DDisconnect all cameras from the network and leave them offline until the attack subsides.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturer of smart thermostats discovers that some devices have been permanently bricked after an attacker exploited a known vulnerability and executed destructive commands that wiped the device firmware. The attack did not use the devices for DDoS traffic. Which attack type matches this behavior?

   • ABrickerBot
   • BMirai
   • CBlackhole
   • DSybil
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a network where some IoT devices are not reporting data. The analyst suspects a blackhole attack. The analyst also notices that the devices were recently configured with default credentials. Which investigation step should the analyst take first to confirm the blackhole attack?

   • AExamine the routing tables of the affected devices to see if they are routing traffic through a common node that is not responding.
   • BBlock the external server IP that the devices are communicating with.
   • CCheck the devices' logs for failed login attempts using default credentials.
   • DReboot the devices to clear any malware.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is responding to an incident where a subset of IoT devices has been bricked by BrickerBot. The team must decide whether to attempt to recover the devices or replace them. The devices are critical to operations, and the budget is limited. Which approach is most appropriate?

   • AReplace all affected devices immediately, regardless of cost, to minimize downtime.
   • BDisconnect the devices and use them as spares for parts.
   • CAttempt to reflash the firmware on the affected devices, but only if the vendor provides a recovery image and the devices are not physically damaged.
   • DLeave the devices offline and wait for the vendor to release a patch.
   Reveal Solution Discussion Select an answer first