A smart city project uses IoT sensors to monitor traffic. The threat modeling team identified a threat where an attacker can send false data to the traffic management system, causing traffic lights to malfunction. They categorize this threat as high impact but low likelihood. What should the team do next?

Prioritize it for mitigation because the impact is high, even though the likelihood is low.

Defer it because the likelihood is low and resources should be spent on more likely threats.

Re-categorize the threat as medium impact to make it easier to handle.

Document it in the threat model but do not recommend any mitigation.

Why is it important to document the threat model and communicate it to stakeholders?

To satisfy legal requirements that all threat models be published publicly

To replace the need for any further security testing

To enable informed decision-making about security investments and risk acceptance

To provide a marketing advantage over competitors

An IoT system for a smart greenhouse includes sensors that communicate via Wi-Fi to a local gateway, which sends data to a cloud server over the internet. The team is performing threat modeling and wants to define trust boundaries. Which of the following should be considered a trust boundary?

The point where the gateway sends data to the cloud server over the internet

The cloud server's storage capacity

The type of crop being monitored

Which of the following is an example of an entry point in an IoT system?

The device's Wi-Fi interface that accepts network connections

In a simple risk scoring model, which combination of factors results in the highest risk score?

High likelihood and high impact

EC-CouncilIoT Security Essentials

Domain 6Objective 4

Threat Modeling ISE Practice Questions (Page 6)

Part of the IoT Incident Response and Security Engineering domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 26–30

26application · medium
A smart city project uses IoT sensors to monitor traffic. The threat modeling team identified a threat where an attacker can send false data to the traffic management system, causing traffic lights to malfunction. They categorize this threat as high impact but low likelihood. What should the team do next?
Select an answer first
27foundation · easy
Why is it important to document the threat model and communicate it to stakeholders?
Select an answer first
28application · easy
An IoT system for a smart greenhouse includes sensors that communicate via Wi-Fi to a local gateway, which sends data to a cloud server over the internet. The team is performing threat modeling and wants to define trust boundaries. Which of the following should be considered a trust boundary?
Select an answer first
29foundation · easy
Which of the following is an example of an entry point in an IoT system?
Select an answer first
30foundation · easy
In a simple risk scoring model, which combination of factors results in the highest risk score?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ISE” is a trademark of its owner, used for identification only.