A security analyst is reviewing alerts from an IoT environment and sees that a smart lock device has an unusual process running, and the device is sending data to an IP address known for malicious activity. Which two types of IoCs are present?

Behavioral and firmware indicators

Network and firmware indicators

In the context of IoT security monitoring, what is the primary purpose of an indicator of compromise (IoC)?

To serve as a baseline for normal device behavior

To encrypt communication between IoT devices and the cloud

To act as a forensic artifact that indicates a potential security incident

To provide a unique identifier for each IoT device on the network

After eradicating malware from a compromised IoT device, the incident response team is planning the recovery phase. Which action is most appropriate for recovery?

Block the device's IP address at the firewall

Perform another forensic analysis

Restore the device to normal operation and monitor for recurrence of IoCs

Keep the device offline indefinitely

EC-CouncilIoT Security Essentials

Domain 6Objective 2

Indicators of Compromise ISE Practice Questions (Page 9)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 41–43

41application · medium
A security analyst is reviewing alerts from an IoT environment and sees that a smart lock device has an unusual process running, and the device is sending data to an IP address known for malicious activity. Which two types of IoCs are present?
Select an answer first
42foundation · easy
In the context of IoT security monitoring, what is the primary purpose of an indicator of compromise (IoC)?
Select an answer first
43application · medium
After eradicating malware from a compromised IoT device, the incident response team is planning the recovery phase. Which action is most appropriate for recovery?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

Indicators of Compromise ISE Practice Questions (Page 9)

Questions 41–43

A security analyst is reviewing alerts from an IoT environment and sees that a smart lock device has an unusual process running, and the device is sending data to an IP address known for malicious activity. Which two types of IoCs are present?

In the context of IoT security monitoring, what is the primary purpose of an indicator of compromise (IoC)?

After eradicating malware from a compromised IoT device, the incident response team is planning the recovery phase. Which action is most appropriate for recovery?

Keep studying — IoT Incident Response and Security Engineering