A company's IoT devices are being attacked, and the IR team needs to isolate a compromised device without losing the ability to analyze its network traffic. Which procedure should the team follow?

Disconnect the device from the network and take it offline

Power off the device immediately

Move the device to a quarantine VLAN and enable port mirroring

Update the device firmware to patch the vulnerability

A hospital's IoT infusion pumps are suspected of being compromised. The pumps are critical for patient care, and disconnecting them would disrupt treatment. The incident response team has confirmed active communication with an unknown external IP. The team must balance patient safety with the need to contain the threat and preserve evidence. Which approach is the BEST?

Leave the pumps connected to gather more evidence.

Power off the pumps immediately to stop the communication.

Update the pump firmware to block the communication.

Isolate the pumps at the network level while maintaining their clinical functionality.

A security team is responding to a suspected IoT breach. They have identified a compromised device but are unsure if it is the source of the breach or just a victim. They need to collect evidence without alerting the attacker. What is the BEST approach?

Monitor the device's network traffic passively while collecting memory and storage images

Immediately disconnect the device and take a forensic image

Reboot the device to clear any malicious processes

Update the device firmware to patch the vulnerability

EC-CouncilIoT Security Essentials

Domain 6Objective 1

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 3)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 11–15

11application · medium
A company's IoT devices are being attacked, and the IR team needs to isolate a compromised device without losing the ability to analyze its network traffic. Which procedure should the team follow?
Select an answer first
12expert · hard
A hospital's IoT infusion pumps are suspected of being compromised. The pumps are critical for patient care, and disconnecting them would disrupt treatment. The incident response team has confirmed active communication with an unknown external IP. The team must balance patient safety with the need to contain the threat and preserve evidence. Which approach is the BEST?
Select an answer first
13application · medium
A security analyst is documenting an IoT incident involving a compromised smart lock. The analyst must ensure that the evidence collected can be used in court. What documentation is essential to maintain the admissibility of the evidence?
Select an answer first
14application · medium
After resolving an IoT security incident, the incident response team is required to produce a document that details what happened, the actions taken, and recommendations for improvement. What document should the team create?
Select an answer first
15expert · hard
A security team is responding to a suspected IoT breach. They have identified a compromised device but are unsure if it is the source of the breach or just a victim. They need to collect evidence without alerting the attacker. What is the BEST approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 3)

Questions 11–15

A company's IoT devices are being attacked, and the IR team needs to isolate a compromised device without losing the ability to analyze its network traffic. Which procedure should the team follow?

A security analyst is documenting an IoT incident involving a compromised smart lock. The analyst must ensure that the evidence collected can be used in court. What documentation is essential to maintain the admissibility of the evidence?

After resolving an IoT security incident, the incident response team is required to produce a document that details what happened, the actions taken, and recommendations for improvement. What document should the team create?

A security team is responding to a suspected IoT breach. They have identified a compromised device but are unsure if it is the source of the breach or just a victim. They need to collect evidence without alerting the attacker. What is the BEST approach?

Keep studying — IoT Incident Response and Security Engineering