A security team is responding to an incident involving a compromised smart camera. They need to collect indicators of compromise for analysis while ensuring the device remains available for forensic examination. Which collection method is most appropriate?

Capture a memory dump and network traffic logs from the camera

Update the camera's firmware to the latest version

Disconnect the camera from the network and power it off

Perform a factory reset to clear any malicious code

After containing a malware infection on a fleet of smart meters, the incident response team is moving to the eradication phase. Which action is most appropriate for eradication?

Monitor the devices for further suspicious activity

Reimage the affected smart meters with known-good firmware

Notify the device vendor of the incident

Block the command-and-control server IP at the firewall

What is the primary purpose of analyzing collected IoCs from IoT devices?

To determine whether a security incident has occurred and understand its scope

To identify the root cause of a vulnerability

To automatically apply security patches to affected devices

To replace the device's firmware with a trusted version

A security analyst is reviewing logs from a smart vending machine that has been tampered with. The machine's network logs show repeated connections to an IP address that is also listed in a threat intelligence feed as a known botnet controller. The analyst wants to use this information to detect other compromised devices. What is the most effective way to leverage this indicator?

Ignore the IP address because it is not a host-based indicator

Search the network logs for any device that has communicated with that IP address

Replace the vending machine's firmware and resume normal operations

Block the IP address at the firewall and consider the incident closed

An IoT security team needs to collect host-based indicators from a fleet of smart TVs that run a proprietary operating system. The TVs do not support third-party security agents. Which method is most appropriate for collecting host IoCs?

Perform network traffic analysis only

Replace the TVs with models that support agents

Install a third-party agent on each TV

Enable the built-in logging and periodically export logs for analysis

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 4)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 16–20

16application · medium
A security team is responding to an incident involving a compromised smart camera. They need to collect indicators of compromise for analysis while ensuring the device remains available for forensic examination. Which collection method is most appropriate?
Select an answer first
17application · medium
After containing a malware infection on a fleet of smart meters, the incident response team is moving to the eradication phase. Which action is most appropriate for eradication?
Select an answer first
18foundation · easy
What is the primary purpose of analyzing collected IoCs from IoT devices?
Select an answer first
19application · medium
A security analyst is reviewing logs from a smart vending machine that has been tampered with. The machine's network logs show repeated connections to an IP address that is also listed in a threat intelligence feed as a known botnet controller. The analyst wants to use this information to detect other compromised devices. What is the most effective way to leverage this indicator?
Select an answer first
20application · medium
An IoT security team needs to collect host-based indicators from a fleet of smart TVs that run a proprietary operating system. The TVs do not support third-party security agents. Which method is most appropriate for collecting host IoCs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.