What is the primary purpose of maintaining a chain of custody document during an IoT incident?

To list the steps taken to contain the incident

To track the cost of the incident response

To ensure evidence is admissible in legal proceedings

To provide a summary of the incident for stakeholders

A smart grid operator detects unusual traffic from a substation's IoT gateway. The operator suspects a malware infection. The team needs to preserve evidence while minimizing operational impact. Which action is MOST appropriate?

Create a forensic image of the gateway's storage and capture network traffic logs before taking any containment action.

Run a full antivirus scan on the gateway.

Disconnect the gateway from the network and then power it down.

Immediately reboot the gateway to clear the malware from memory.

During an IoT incident, the communication lead is responsible for coordinating with external stakeholders. Which task is the communication lead MOST likely to perform?

Drafting a press release and notifying regulatory bodies about the incident.

Isolating affected devices from the network.

Analyzing malware samples to identify the attack vector.

Determining the root cause of the incident.

EC-CouncilIoT Security Essentials

Domain 6Objective 1

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 5)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 21–25

21application · medium
A hospital's IoT infusion pumps were bricked by ransomware. The IR team has isolated the affected network segment and is now deciding whether to restore from backups or wipe and reimage. Which phase of the incident response process are they currently executing?
Select an answer first
22foundation · easy
What is the primary purpose of maintaining a chain of custody document during an IoT incident?
Select an answer first
23application · medium
A smart grid operator detects unusual traffic from a substation's IoT gateway. The operator suspects a malware infection. The team needs to preserve evidence while minimizing operational impact. Which action is MOST appropriate?
Select an answer first
24application · medium
During an IoT incident, the response team needs to keep stakeholders informed about the status of the response. Which role is responsible for managing communications with external parties such as customers and regulators?
Select an answer first
25application · medium
During an IoT incident, the communication lead is responsible for coordinating with external stakeholders. Which task is the communication lead MOST likely to perform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 5)

Questions 21–25

A hospital's IoT infusion pumps were bricked by ransomware. The IR team has isolated the affected network segment and is now deciding whether to restore from backups or wipe and reimage. Which phase of the incident response process are they currently executing?

What is the primary purpose of maintaining a chain of custody document during an IoT incident?

A smart grid operator detects unusual traffic from a substation's IoT gateway. The operator suspects a malware infection. The team needs to preserve evidence while minimizing operational impact. Which action is MOST appropriate?

During an IoT incident, the response team needs to keep stakeholders informed about the status of the response. Which role is responsible for managing communications with external parties such as customers and regulators?

During an IoT incident, the communication lead is responsible for coordinating with external stakeholders. Which task is the communication lead MOST likely to perform?

Keep studying — IoT Incident Response and Security Engineering