A smart building's HVAC controller has been operating normally for years. Recently, it began sending data to an external IP address in a foreign country at 3:00 AM daily, and its firmware version changed from 2.1 to 2.1.1 without any authorized update. The facility manager wants to confirm a compromise. Which combination of indicators provides the strongest evidence?

The firmware version change alone

Unauthorized firmware change and unexpected outbound connection

The time of day (3:00 AM) and the foreign IP address

During the containment phase of an IoT incident response, which action is most directly guided by IoCs?

Deleting all logs to prevent further data collection

Identifying which devices are compromised and isolating them from the network

Restoring the device firmware from a known-good backup

Conducting a post-incident review to document lessons learned

An incident response team is analyzing a compromise of IoT devices in a smart agriculture environment. They have identified the following indicators: (1) irrigation controllers are sending data to an unknown IP, (2) the firmware on the controllers has been modified, and (3) the controllers are activating at unusual times. The team needs to decide whether to treat this as a single incident or multiple incidents. Which approach is best?

Ignore the behavioral indicator and focus on the network indicator

Treat each indicator as a separate incident

Correlate the indicators to determine if they share a common source

Rebuild all devices immediately

A security team is collecting IoCs from a compromised IoT environment. They have network logs, device logs, and firmware hashes. The team needs to analyze the data to identify the attack pattern. Which approach is most effective?

Analyze each data source independently

Correlate the network logs, device logs, and firmware hashes to identify commonalities

Delete the logs after confirming the malware

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 7)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 31–35

31application · medium
A smart building's HVAC controller has been operating normally for years. Recently, it began sending data to an external IP address in a foreign country at 3:00 AM daily, and its firmware version changed from 2.1 to 2.1.1 without any authorized update. The facility manager wants to confirm a compromise. Which combination of indicators provides the strongest evidence?
Select an answer first
32foundation · easy
During the containment phase of an IoT incident response, which action is most directly guided by IoCs?
Select an answer first
33expert · hard
An incident response team is analyzing a compromise of IoT devices in a smart agriculture environment. They have identified the following indicators: (1) irrigation controllers are sending data to an unknown IP, (2) the firmware on the controllers has been modified, and (3) the controllers are activating at unusual times. The team needs to decide whether to treat this as a single incident or multiple incidents. Which approach is best?
Select an answer first
34expert · hard
A security team is collecting IoCs from a compromised IoT environment. They have network logs, device logs, and firmware hashes. The team needs to analyze the data to identify the attack pattern. Which approach is most effective?
Select an answer first
35foundation · easy
Which category of IoC would a sudden change in an IoT device's normal operating schedule (e.g., a smart thermostat turning on at odd hours) fall under?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Indicators of Compromise ISE Practice Questions (Page 7)

Questions 31–35

During the containment phase of an IoT incident response, which action is most directly guided by IoCs?

A security team is collecting IoCs from a compromised IoT environment. They have network logs, device logs, and firmware hashes. The team needs to analyze the data to identify the attack pattern. Which approach is most effective?

Which category of IoC would a sudden change in an IoT device's normal operating schedule (e.g., a smart thermostat turning on at odd hours) fall under?

Keep studying — IoT Incident Response and Security Engineering