A security team is investigating a series of IoT device failures. Some devices were bricked by a destructive malware, while others were used in a DDoS attack. The team also suspects a Sybil attack in the network. Which investigation approach would best identify the root causes and prevent future incidents?

Analyze device logs for destructive commands, review network traffic for DDoS patterns, and audit device identities for duplicates.

Disconnect all devices from the network and reconnect them one by one.

Focus only on the destructive malware and ignore the DDoS and Sybil attacks.

Reboot all devices and change all passwords.

How does the Mirai botnet typically compromise IoT devices to build its attack network?

By exploiting a zero-day vulnerability in the device's web interface

By tricking users into installing a malicious mobile app that infects the device

By brute-forcing unique, strong passwords on each device

By guessing default and hardcoded credentials on exposed Telnet/SSH services

A security analyst discovers that a batch of newly deployed IP cameras in a warehouse has been compromised and is now sending traffic to a command-and-control server. The cameras were configured with default admin passwords. The analyst must contain the threat and prevent recurrence. Which action should the analyst take first?

Block the command-and-control server IP at the firewall and leave the cameras online.

Apply the latest firmware updates to the cameras while they remain connected to the network.

Disconnect the cameras from the network and change all default credentials to strong unique passwords.

Reboot the cameras to clear the malware from memory and then monitor network traffic.

EC-CouncilIoT Security Essentials

Domain 4Objective 1

Common IoT Attacks (Mirai, BrickerBot, Sybil, Blackhole) ISE Practice Questions (Page 5)

Part of the IoT Threats and Basic Security domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

4concepts

Questions 21–25

21application · medium
A company's IP cameras are sending a large volume of traffic to a single target, overwhelming it. The cameras were accessed using their default passwords. Which attack is this?
Select an answer first
22expert · hard
A security team is investigating a series of IoT device failures. Some devices were bricked by a destructive malware, while others were used in a DDoS attack. The team also suspects a Sybil attack in the network. Which investigation approach would best identify the root causes and prevent future incidents?
Select an answer first
23foundation · easy
How does the Mirai botnet typically compromise IoT devices to build its attack network?
Select an answer first
24application · medium
A security analyst discovers that a batch of newly deployed IP cameras in a warehouse has been compromised and is now sending traffic to a command-and-control server. The cameras were configured with default admin passwords. The analyst must contain the threat and prevent recurrence. Which action should the analyst take first?
Select an answer first
25application · medium
In a wireless sensor network used for environmental monitoring, a single malicious node registers hundreds of fake identities with the routing protocol. As a result, the network's routing tables become flooded with false neighbors, and legitimate data is misrouted. Which attack is being performed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Common IoT Attacks (Mirai, BrickerBot, Sybil, Blackhole) ISE Practice Questions (Page 5)

Questions 21–25

A company's IP cameras are sending a large volume of traffic to a single target, overwhelming it. The cameras were accessed using their default passwords. Which attack is this?

How does the Mirai botnet typically compromise IoT devices to build its attack network?

In a wireless sensor network used for environmental monitoring, a single malicious node registers hundreds of fake identities with the routing protocol. As a result, the network's routing tables become flooded with false neighbors, and legitimate data is misrouted. Which attack is being performed?

Keep studying — IoT Threats and Basic Security