An IoT security analyst is documenting an incident involving a compromised smart meter. The analyst needs to ensure that the evidence collected can be used in legal proceedings. Which documentation practice is MOST critical?

Maintaining a detailed chain of custody log for all evidence.

Storing evidence in a shared folder with open access.

Writing a summary of the incident for the company blog.

Deleting logs that are not directly related to the incident.

An IoT device in a hospital has been compromised, and the IR team needs to isolate it without disrupting patient care. The device is critical for monitoring a patient's vital signs. What is the BEST approach?

Ignore the incident until the patient is discharged

Disconnect the device from the network immediately

Isolate the device on a separate VLAN while maintaining its functionality

Power off the device and replace it with a spare

A hospital's IoT infusion pumps are suspected of being compromised. The incident response team has confirmed the pumps are communicating with an unknown external IP. The team needs to stop the immediate threat while preserving the ability to investigate. Which action should the team take FIRST?

Power off the pumps to prevent further data exfiltration.

Isolate the affected pumps from the network by disconnecting them from the switch port.

Update the pump firmware to the latest version.

Reconfigure the pumps to use a different network segment.

After resolving an IoT security incident, the incident response team is preparing the post-incident report. Which element is MOST important to include to support future prevention?

A detailed timeline of the incident and the actions taken.

The cost of the incident in terms of lost productivity.

A list of all software versions on affected devices.

The names of all employees involved in the response.

EC-CouncilIoT Security Essentials

Domain 6Objective 1

IoT Incident Response Standards, Processes, and Procedures ISE Practice Questions (Page 7)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 31–35

31application · medium
An IoT security analyst is documenting an incident involving a compromised smart meter. The analyst needs to ensure that the evidence collected can be used in legal proceedings. Which documentation practice is MOST critical?
Select an answer first
32foundation · easy
Which role in an IoT incident response team is primarily responsible for collecting and analyzing digital evidence from compromised devices?
Select an answer first
33application · medium
An IoT device in a hospital has been compromised, and the IR team needs to isolate it without disrupting patient care. The device is critical for monitoring a patient's vital signs. What is the BEST approach?
Select an answer first
34application · medium
A hospital's IoT infusion pumps are suspected of being compromised. The incident response team has confirmed the pumps are communicating with an unknown external IP. The team needs to stop the immediate threat while preserving the ability to investigate. Which action should the team take FIRST?
Select an answer first
35application · medium
After resolving an IoT security incident, the incident response team is preparing the post-incident report. Which element is MOST important to include to support future prevention?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.