A security team is investigating a potential compromise of a smart building's lighting system. The team has collected network flow logs, device syslogs, and firmware hashes from the lighting controllers. They need to analyze these data to identify any indicators of compromise. Which analysis technique is most effective for correlating the data?

Focus only on the firmware hashes and ignore the network logs

Manually review each log file for anomalies

Compare the firmware hashes to the vendor's known-good hashes

Use a SIEM to aggregate and correlate the logs and hashes

A security analyst at a manufacturing plant notices that several programmable logic controllers (PLCs) are sending Modbus TCP packets to an internal file server that has no operational relationship with the control network. The packets are small, periodic, and originate from the PLCs' normal IP addresses. The analyst needs to determine whether this is a host-based or network-based indicator. Which classification is most accurate?

Hybrid indicator, because it involves both hosts and the network

Host indicator, because the PLCs are the source of the traffic

Network indicator, because the anomaly is observed in the traffic between devices

Behavioral indicator, because the PLCs are behaving unusually

During the recovery phase of an incident, a security team has contained and eradicated a compromise on a smart vending machine. The machine has been restored to a known-good state. What is the next step in the recovery phase?

Change the device's default credentials

Reconnect the device to the network and resume normal operations immediately

Monitor the device for any signs of re-infection

Conduct a full forensic analysis of the device

Which method is commonly used to collect IoCs from IoT devices for analysis?

Physically inspecting the device for tamper evidence

Using a vulnerability scanner to patch the device

Deploying network taps and packet capture devices to monitor traffic

Disabling the device's logging features to reduce noise

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 6)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 26–30

26expert · hard
A security team is investigating a potential compromise of a smart building's lighting system. The team has collected network flow logs, device syslogs, and firmware hashes from the lighting controllers. They need to analyze these data to identify any indicators of compromise. Which analysis technique is most effective for correlating the data?
Select an answer first
27application · medium
A security analyst is monitoring a smart irrigation system. The system's controller has been sending an unusually high volume of data to a cloud service that is not the vendor's official service. The analyst also notices that the controller's firmware version has changed to a version that is not listed on the vendor's website. Which type of IoC is most directly indicated by the firmware version change?
Select an answer first
28application · medium
A security analyst at a manufacturing plant notices that several programmable logic controllers (PLCs) are sending Modbus TCP packets to an internal file server that has no operational relationship with the control network. The packets are small, periodic, and originate from the PLCs' normal IP addresses. The analyst needs to determine whether this is a host-based or network-based indicator. Which classification is most accurate?
Select an answer first
29application · medium
During the recovery phase of an incident, a security team has contained and eradicated a compromise on a smart vending machine. The machine has been restored to a known-good state. What is the next step in the recovery phase?
Select an answer first
30foundation · easy
Which method is commonly used to collect IoCs from IoT devices for analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Indicators of Compromise ISE Practice Questions (Page 6)

Questions 26–30

During the recovery phase of an incident, a security team has contained and eradicated a compromise on a smart vending machine. The machine has been restored to a known-good state. What is the next step in the recovery phase?

Which method is commonly used to collect IoCs from IoT devices for analysis?

Keep studying — IoT Incident Response and Security Engineering