Indicators of Compromise ISE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which scenario best illustrates the correlation of IoCs to identify a broader attack campaign?

   • AMultiple IoT devices in different locations communicate with the same malicious IP address and have similar firmware anomalies.
   • BA single device shows high CPU usage, and the analyst reboots it.
   • COne device has an open port, and the analyst closes it.
   • DA device sends an email alert to the administrator.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is monitoring a smart lighting system and notices that the lights are turning on and off at random times, despite no user commands. The network traffic from the lighting controller is normal, and the firmware hash matches the vendor's official version. Which type of IoC is most likely present?

   • ABehavioral indicator
   • BNetwork indicator
   • CFirmware anomaly
   • DHost indicator
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An incident response team is handling a compromise of IoT devices in a hospital. The team has collected network logs showing connections to a suspicious domain, host logs showing a new process running on a gateway, and behavioral data showing devices rebooting at odd times. The team needs to determine if these are related to a single attack campaign. Which step is most appropriate?

   • ACorrelate the indicators across time and affected devices
   • BDisconnect the hospital network from the internet
   • CRebuild all devices from known-good images
   • DIsolate each device and analyze it separately
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is investigating a series of anomalies across multiple IoT devices: several smart TVs are sending data to a known malicious domain, a few smart speakers have unusual firmware versions, and a smart doorbell has been sending false motion alerts. The analyst wants to determine if these are part of a single campaign. Which approach is most effective?

   • AIsolate all devices immediately without further analysis
   • BCorrelate the timing and communication patterns across all devices
   • CFocus on the most severe anomaly, the doorbell, and ignore the others
   • DTreat each device type as a separate incident
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During incident response for a compromised fleet of smart cameras, the response team has confirmed the presence of a known botnet malware. The cameras are still communicating with a command-and-control server. Which action should be taken FIRST in the containment phase?

   • AUpdate the camera firmware to the latest version
   • BCollect forensic images from all cameras
   • CBlock outbound traffic from the cameras to the command-and-control server
   • DReboot all cameras to clear the malware
   Reveal Solution Discussion Select an answer first