IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has just resolved a major IoT incident. The IR team is writing the post-incident report. The legal department has requested that the report include all evidence handling details, while the management wants a concise summary. What is the BEST way to satisfy both requirements?

   • ADelay the report until legal and management agree on a single format
   • BCreate two versions: a detailed report for legal and a summary for management
   • CSend only a summary report to legal, omitting evidence handling details
   • DCreate a single detailed report that includes all evidence handling details and send it to all stakeholders
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which international standard provides a structured approach to incident management, including preparation, detection, reporting, assessment, and response?

   • AISO/IEC 27002
   • BNIST SP 800-61
   • CNIST SP 800-115
   • DISO/IEC 27035
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which phase of the IoT incident response process involves restoring affected devices and systems to normal operation after the incident has been contained and eradicated?

   • ADetection
   • BLessons learned
   • CPreparation
   • DRecovery
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst discovers that a smart building's HVAC controller has been sending data to an unauthorized server. The analyst needs to collect evidence for potential legal action. Which action BEST supports the chain of custody?

   • AEmail the log files to the legal department for safekeeping.
   • BCopy the device's log files to a USB drive and store it in a desk drawer.
   • CTake a screenshot of the network traffic and save it to a shared drive.
   • DDocument every person who handles the evidence and every time it changes hands.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A smart home device manufacturer has detected a vulnerability in its cloud-connected cameras. The incident response team is in the eradication phase. Which action is MOST appropriate?

   • ACollect forensic images from a sample of cameras.
   • BRestore the cameras to factory settings.
   • CDeploy a firmware patch to all affected cameras and verify the vulnerability is removed.
   • DNotify customers about the vulnerability.
   Reveal Solution Discussion Select an answer first