A security analyst is reviewing a report on a compromised IoT device. The report includes: (1) an unusual process running on the device, (2) the device sending data to a suspicious IP, and (3) the device rebooting at odd times. Which combination of IoC types is present?

Network and behavioral indicators only

Host and network indicators only

Host, network, and behavioral indicators

Host and behavioral indicators only

Which of the following is a common IoC specific to IoT devices?

An increase in the device's screen brightness

A new browser bookmark on the device

A change in the device's MAC address

An unexpected change in the device's firmware hash

A security analyst is explaining to a new team member the role of indicators of compromise (IoCs) in IoT security. Which statement best describes the role of IoCs?

They are artifacts observed on a system or network that indicate a potential intrusion

They are security policies that define acceptable device behavior

They are patches applied to fix security flaws

They are vulnerabilities that attackers exploit to gain access

A security analyst is investigating a series of anomalies across multiple IoT devices: several IP cameras have firmware hashes that differ from the vendor's signed versions, a smart thermostat is sending data to a known malicious domain, and a smart lock has been unlocking at random times. The analyst wants to determine if these are separate incidents or part of a coordinated campaign. Which approach is most effective?

Focus only on the most severe anomaly, the smart lock, and ignore the others

Correlate the timing, communication patterns, and any shared infrastructure across the anomalies

Treat each anomaly as an independent incident and respond separately

Isolate all devices immediately without further analysis

An IoT security team needs to collect indicators of compromise from a fleet of smart meters that communicate over a low-power mesh network. The meters have limited storage and processing capabilities. Which collection method is most appropriate for this environment?

Enable flow logging on the mesh network gateway and analyze traffic summaries centrally

Manually inspect each meter's firmware hash during routine maintenance

Install an endpoint detection agent on each smart meter

Capture full packet captures on each meter's network interface

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 2)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 6–10

6application · medium
A security analyst is reviewing a report on a compromised IoT device. The report includes: (1) an unusual process running on the device, (2) the device sending data to a suspicious IP, and (3) the device rebooting at odd times. Which combination of IoC types is present?
Select an answer first
7foundation · easy
Which of the following is a common IoC specific to IoT devices?
Select an answer first
8application · easy
A security analyst is explaining to a new team member the role of indicators of compromise (IoCs) in IoT security. Which statement best describes the role of IoCs?
Select an answer first
9expert · hard
A security analyst is investigating a series of anomalies across multiple IoT devices: several IP cameras have firmware hashes that differ from the vendor's signed versions, a smart thermostat is sending data to a known malicious domain, and a smart lock has been unlocking at random times. The analyst wants to determine if these are separate incidents or part of a coordinated campaign. Which approach is most effective?
Select an answer first
10application · medium
An IoT security team needs to collect indicators of compromise from a fleet of smart meters that communicate over a low-power mesh network. The meters have limited storage and processing capabilities. Which collection method is most appropriate for this environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.