IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A utility company has experienced a cyber incident affecting its IoT-based grid sensors. The company must report the incident to regulators within 72 hours. The incident response team is still in the containment phase and has not completed a full analysis. What is the BEST course of action?

   • AWait until the analysis is complete before reporting to avoid incomplete information.
   • BProvide an initial report with available facts and commit to a follow-up report after analysis.
   • CAsk legal counsel to delay the report until the investigation is finished.
   • DReport only the technical details and omit the business impact.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When an IoT device is suspected of being compromised, what is the immediate procedure to prevent further spread while preserving evidence?

   • ADelete suspicious files from the device
   • BUpdate the device firmware
   • CPower off the device immediately
   • DIsolate the device from the network
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During an IoT incident, the incident commander is unavailable. The team must continue the response. Which role should assume the incident commander's responsibilities to ensure the response continues effectively?

   • AThe communication lead
   • BThe IT manager
   • CThe most senior forensic analyst
   • DA designated deputy incident commander
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst discovers that a smart thermostat in a corporate office has been sending data to an unknown external IP. The analyst needs to preserve evidence for potential legal action. What should the analyst do FIRST?

   • AReboot the thermostat to clear any malicious processes
   • BNotify the device manufacturer and request a firmware update
   • CTake a forensic image of the thermostat's storage and capture network logs
   • DDisconnect the thermostat from the network immediately
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A large-scale IoT botnet attack is underway, and the IR team is struggling to coordinate. The incident commander is making decisions, but the forensic analysts are not providing timely findings, and the communication lead is sending conflicting messages to stakeholders. What is the MOST LIKELY cause of these issues?

   • AThe forensic analysts are not skilled enough
   • BThe communication lead is not following the incident commander's instructions
   • CThe incident commander is not delegating tasks effectively
   • DThe team lacks clear roles and responsibilities
   Reveal Solution Discussion Select an answer first