A security team is investigating a series of IoT device compromises. They have collected the following indicators: (1) multiple devices communicating with the same unknown IP, (2) a new user account created on several devices, and (3) devices sending data at unusual times. Which conclusion is best supported by correlating these indicators?

The devices are misconfigured by the administrator

The devices have a common hardware defect

The devices are experiencing network congestion

The devices are part of a coordinated botnet

An IoT security team needs to collect indicators of compromise from a mix of legacy and modern IoT devices in a manufacturing plant. The devices are on a segmented network, and the team wants to minimize disruption to production. Which approach is most appropriate for collecting IoCs?

Query each device's management interface for logs

Disconnect devices one by one and perform forensic imaging

Install endpoint detection agents on every IoT device

Deploy network taps and collect traffic metadata at the segment boundaries

How are IoCs used in the eradication phase of IoT incident response?

To restore the device to normal operation by reconnecting it to the network

To determine the financial impact of the incident

To identify the malicious files or processes that need to be removed from the device

To decide whether to notify law enforcement

A security analyst notices that a group of smart locks in a hotel are unlocking at random times, but only when the hotel's Wi-Fi network is under heavy load. The locks' firmware hashes are unchanged, and there are no unusual network connections. The analyst suspects a denial-of-service attack on the Wi-Fi network. Which indicator would best support this hypothesis?

A change in the smart locks' firmware version

An increase in the number of devices connected to the Wi-Fi network

A correlation between the unlock events and periods of high network latency or packet loss

A spike in the smart locks' CPU usage

A security analyst is monitoring a fleet of smart locks. Which of the following are examples of behavioral indicators of compromise for these devices? Select all that apply.

The lock's firmware version changing unexpectedly

The lock unlocking at random times without user input

The lock's battery draining faster than usual

The lock's MAC address changing

The lock sending data to an unknown server

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 3)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 11–15

11expert · hard
A security team is investigating a series of IoT device compromises. They have collected the following indicators: (1) multiple devices communicating with the same unknown IP, (2) a new user account created on several devices, and (3) devices sending data at unusual times. Which conclusion is best supported by correlating these indicators?
Select an answer first
12application · medium
An IoT security team needs to collect indicators of compromise from a mix of legacy and modern IoT devices in a manufacturing plant. The devices are on a segmented network, and the team wants to minimize disruption to production. Which approach is most appropriate for collecting IoCs?
Select an answer first
13foundation · easy
How are IoCs used in the eradication phase of IoT incident response?
Select an answer first
14expert · hard
A security analyst notices that a group of smart locks in a hotel are unlocking at random times, but only when the hotel's Wi-Fi network is under heavy load. The locks' firmware hashes are unchanged, and there are no unusual network connections. The analyst suspects a denial-of-service attack on the Wi-Fi network. Which indicator would best support this hypothesis?
Select an answer first
15application · medium · select all that apply
A security analyst is monitoring a fleet of smart locks. Which of the following are examples of behavioral indicators of compromise for these devices? Select all that apply.
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Indicators of Compromise ISE Practice Questions (Page 3)

Questions 11–15

An IoT security team needs to collect indicators of compromise from a mix of legacy and modern IoT devices in a manufacturing plant. The devices are on a segmented network, and the team wants to minimize disruption to production. Which approach is most appropriate for collecting IoCs?

How are IoCs used in the eradication phase of IoT incident response?

A security analyst is monitoring a fleet of smart locks. Which of the following are examples of behavioral indicators of compromise for these devices? Select all that apply.

Keep studying — IoT Incident Response and Security Engineering