Indicators of Compromise ISE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is reviewing logs from a smart refrigerator that has been acting strangely. The logs show that the refrigerator has been sending data to an IP address that is not in the vendor's list of known servers. The analyst wants to determine if this is an indicator of compromise. What is the most appropriate first step?

   • AIgnore the IP address because it is not a standard indicator
   • BCheck if the IP address is associated with known malicious activity in threat intelligence feeds
   • CChange the refrigerator's Wi-Fi password
   • DImmediately disconnect the refrigerator from the network
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst at a smart-building company notices that a fleet of IoT thermostats is sending data to an external IP address that is not the vendor's cloud. The thermostats are still reporting temperature readings normally, but the network traffic pattern is unusual. Which type of indicator of compromise is most directly observed in this scenario?

   • ABehavioral indicator
   • BFirmware anomaly
   • CNetwork indicator
   • DHost indicator
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which statement best describes the role of indicators of compromise (IoCs) in an IoT incident response process?

   • AThey replace the need for continuous monitoring of IoT devices.
   • BThey help security teams detect and respond to security incidents by providing observable evidence of compromise.
   • CThey are used to automatically patch vulnerabilities in IoT firmware.
   • DThey are used to configure firewall rules for IoT networks.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why is correlating multiple IoCs important in IoT security monitoring?

   • AIt reduces the number of false positives by ignoring individual IoCs.
   • BIt eliminates the need for further investigation of individual alerts.
   • CIt automatically quarantines all affected devices.
   • DIt helps identify broader attack patterns and campaigns that might otherwise go unnoticed.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During the recovery phase of an IoT incident, the response team has eradicated the malware and restored the devices. Which action is most important to complete the recovery phase?

   • AReimage all devices again
   • BBlock all outbound traffic from the IoT network
   • CMonitor the devices for a period to ensure no recurrence of indicators
   • DDisconnect the devices from the network permanently
   Reveal Solution Discussion Select an answer first