An incident responder is investigating a compromise that affected multiple IoT devices in a hospital. The devices include smart infusion pumps, patient monitors, and a building access control system. The responder has identified that all devices are communicating with the same command-and-control server. What is the most important next step in the incident response process?

Eradicate the threat by updating firmware on all devices

Contain the affected devices by disconnecting them from the network

Conduct a full forensic analysis before taking any action

Recover by restoring devices from backups

During incident response, a security team has identified that a batch of smart bulbs is compromised and communicating with a command-and-control server. The team needs to contain the incident while preserving evidence for analysis. Which action should be taken first?

Update the firmware on all smart bulbs to the latest version

Immediately reset all smart bulbs to factory settings

Disconnect the affected smart bulbs from the network

Ignore the issue and monitor the network for further activity

Which of the following is an example of an abnormal network traffic pattern that could indicate a compromised IoT device?

The device sending a small amount of data to a local gateway at regular intervals

The device receiving a firmware update from the vendor's official update server

The device sending a heartbeat message every 60 seconds to the cloud

The device communicating with a server in a foreign country at 3:00 AM

Which of the following is an example of a network-based indicator of compromise (IoC) for an IoT device?

An increase in CPU usage on the device

A change in the device's firmware version

A new user account created on the device

An unexpected outbound connection to a known malicious IP address

A security analyst is investigating a suspected compromise of smart vending machines. The analyst observes: (1) the machines are sending small amounts of data to a known malicious IP, (2) the firmware version reported by the machines has changed to an unofficial build, and (3) the machines reboot at odd times. Which conclusion is best supported by correlating these indicators?

The devices have a hardware failure

The devices are experiencing normal network issues

The devices are misconfigured by the vendor

The devices are likely part of a coordinated attack campaign

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 5)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 21–25

21expert · hard
An incident responder is investigating a compromise that affected multiple IoT devices in a hospital. The devices include smart infusion pumps, patient monitors, and a building access control system. The responder has identified that all devices are communicating with the same command-and-control server. What is the most important next step in the incident response process?
Select an answer first
22application · medium
During incident response, a security team has identified that a batch of smart bulbs is compromised and communicating with a command-and-control server. The team needs to contain the incident while preserving evidence for analysis. Which action should be taken first?
Select an answer first
23foundation · easy
Which of the following is an example of an abnormal network traffic pattern that could indicate a compromised IoT device?
Select an answer first
24foundation · easy
Which of the following is an example of a network-based indicator of compromise (IoC) for an IoT device?
Select an answer first
25expert · hard
A security analyst is investigating a suspected compromise of smart vending machines. The analyst observes: (1) the machines are sending small amounts of data to a known malicious IP, (2) the firmware version reported by the machines has changed to an unofficial build, and (3) the machines reboot at odd times. Which conclusion is best supported by correlating these indicators?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Indicators of Compromise ISE Practice Questions (Page 5)

Questions 21–25

During incident response, a security team has identified that a batch of smart bulbs is compromised and communicating with a command-and-control server. The team needs to contain the incident while preserving evidence for analysis. Which action should be taken first?

Which of the following is an example of an abnormal network traffic pattern that could indicate a compromised IoT device?

Which of the following is an example of a network-based indicator of compromise (IoC) for an IoT device?

Keep studying — IoT Incident Response and Security Engineering