During a ransomware incident affecting a factory's IoT sensors, the incident response team is activated. The team includes a network engineer, a malware analyst, a public relations specialist, and a senior manager. Who should be designated as the incident commander?

The malware analyst, because they understand the threat best.

The senior manager, to provide authority and coordinate resources.

The network engineer, because they can isolate the affected systems.

The public relations specialist, because they manage external communications.

After a major IoT incident, the IR team is preparing the post-incident report. The report must include a timeline of events, root cause analysis, and recommendations. However, the team is concerned about legal liability if the report is discovered in litigation. What is the BEST way to handle this concern?

Write the report with the assistance of legal counsel to protect it under attorney-client privilege

Write the report and include all details, including potential legal liabilities

Write a report that omits any mention of mistakes or failures

Do not write a post-incident report to avoid legal liability

What is the main purpose of a post-incident report in IoT incident response?

To document lessons learned and improve future response

To serve as a legal document for prosecution

To list the evidence collected during the incident

To provide real-time updates during the incident

A company's IoT devices are infected with a worm that spreads rapidly. The IR team must decide whether to contain the infection by disconnecting all devices or to let some devices remain connected to gather intelligence. What is the BEST course of action?

Leave all devices connected to gather maximum intelligence

Power off all devices and restart them later

Disconnect all devices immediately to stop the spread

Disconnect most devices but keep a few in a controlled environment for analysis

EC-CouncilIoT Security Essentials

Domain 6Objective 1

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 6)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 26–30

26foundation · easy
Which standard is specifically focused on providing guidelines for computer security incident handling, including preparation, detection, analysis, containment, eradication, and recovery?
Select an answer first
27application · medium
During a ransomware incident affecting a factory's IoT sensors, the incident response team is activated. The team includes a network engineer, a malware analyst, a public relations specialist, and a senior manager. Who should be designated as the incident commander?
Select an answer first
28expert · hard
After a major IoT incident, the IR team is preparing the post-incident report. The report must include a timeline of events, root cause analysis, and recommendations. However, the team is concerned about legal liability if the report is discovered in litigation. What is the BEST way to handle this concern?
Select an answer first
29foundation · easy
What is the main purpose of a post-incident report in IoT incident response?
Select an answer first
30expert · hard
A company's IoT devices are infected with a worm that spreads rapidly. The IR team must decide whether to contain the infection by disconnecting all devices or to let some devices remain connected to gather intelligence. What is the BEST course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 6)

Questions 26–30

Which standard is specifically focused on providing guidelines for computer security incident handling, including preparation, detection, analysis, containment, eradication, and recovery?

During a ransomware incident affecting a factory's IoT sensors, the incident response team is activated. The team includes a network engineer, a malware analyst, a public relations specialist, and a senior manager. Who should be designated as the incident commander?

What is the main purpose of a post-incident report in IoT incident response?

A company's IoT devices are infected with a worm that spreads rapidly. The IR team must decide whether to contain the infection by disconnecting all devices or to let some devices remain connected to gather intelligence. What is the BEST course of action?

Keep studying — IoT Incident Response and Security Engineering