A network engineer is troubleshooting a wireless sensor network that is experiencing intermittent data loss. The engineer suspects either a Sybil attack or a blackhole attack. Which observation would most strongly indicate a Sybil attack rather than a blackhole attack?

The network's routing table contains many more nodes than the physical number of devices deployed.

The data loss is occurring only on a specific path through the network.

A specific node is advertising itself as the best route to all destinations.

The network's overall traffic volume has increased significantly.

A security consultant is advising a client on how to protect their IoT devices from Mirai botnet attacks. The client also wants to protect against BrickerBot and blackhole attacks. Which recommendation would be most effective in addressing all three threats?

Apply firmware patches to all devices.

Use a firewall to block all inbound traffic.

Change default credentials, segment the network, and implement routing security.

Disconnect all devices from the internet.

A network architect is designing a wireless sensor network for a military application. The network must be resilient against Sybil attacks and blackhole attacks. The architect has limited computational resources on the sensor nodes. Which approach best balances security and resource constraints?

Use a centralized controller that authenticates every node before it joins the network.

Deploy a public key infrastructure (PKI) with certificates on every node.

Use a lightweight reputation-based routing protocol that monitors node behavior and isolates nodes that drop packets or exhibit identity anomalies.

Implement a fully mesh network with multiple redundant paths to each destination.

In a Sybil attack on an IoT network, what does a single malicious node do?

It intercepts and modifies data between two legitimate nodes

It drops all routing packets that pass through it

It floods the network with useless broadcast messages

It creates multiple fake identities to influence network decisions

EC-CouncilIoT Security Essentials

Domain 4Objective 1

Common IoT Attacks (Mirai, BrickerBot, Sybil, Blackhole) ISE Practice Questions (Page 4)

Part of the IoT Threats and Basic Security domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

4concepts

Questions 16–20

16expert · hard
A network engineer is troubleshooting a wireless sensor network that is experiencing intermittent data loss. The engineer suspects either a Sybil attack or a blackhole attack. Which observation would most strongly indicate a Sybil attack rather than a blackhole attack?
Select an answer first
17application · medium
A company deploys hundreds of smart sensors that use default credentials. A security consultant warns that these devices could be compromised by a botnet that uses default credentials to recruit devices for DDoS attacks. Which attack is the consultant referring to?
Select an answer first
18expert · hard
A security consultant is advising a client on how to protect their IoT devices from Mirai botnet attacks. The client also wants to protect against BrickerBot and blackhole attacks. Which recommendation would be most effective in addressing all three threats?
Select an answer first
19expert · hard
A network architect is designing a wireless sensor network for a military application. The network must be resilient against Sybil attacks and blackhole attacks. The architect has limited computational resources on the sensor nodes. Which approach best balances security and resource constraints?
Select an answer first
20foundation · easy
In a Sybil attack on an IoT network, what does a single malicious node do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.