hardMultiple ChoiceObjective-mapped
First Step in Incident Response: Contain the Affected Server
A healthcare organization has implemented a data classification policy with three levels: Public, Internal, and Restricted. The IT department recently received a report of a potential data breach. An internal auditor discovered that a database containing Protected Health Information (PHI) classified as Restricted was accessible via a web application that did not enforce encryption in transit. The web application uses HTTPS, but the auditor found that the connection was downgraded to HTTP due to a misconfiguration in the load balancer. Additionally, the database logs show that an external IP address queried the database for thousands of patient records over a two-hour period. The database was configured to allow only specific internal application servers, but the firewall rule was incorrectly set to allow connections from any IP address. The security team needs to determine the most effective immediate action to prevent further unauthorized access and protect the data. Which course of action should the security team take FIRST?
Quick Answer
The answer is to correct the firewall rule to restrict database access to only the application servers. This is the most effective immediate containment action because the misconfigured firewall rule is the root cause enabling the external attacker to directly query the database from any IP address, bypassing all other controls. By correcting this rule, the security team cuts off unauthorized network access at the network layer, stopping the ongoing data exfiltration regardless of the encryption or web application issues. On the CISA exam, this scenario tests your understanding of the incident response priority: containment first, and specifically that network-layer controls (firewall rules) take precedence over encryption or application fixes when they are the direct vector of the breach. A common trap is to focus on enabling HTTPS or fixing the load balancer, but those address data-in-transit exposure, not the immediate unauthorized access. Memory tip: “Fix the gate before patching the window”—stop the direct path of the attacker first.
⚠ Common exam trap
The trap here is that candidates focus on the encryption downgrade (HTTPS to HTTP) or the external IP address, but the core vulnerability is the misconfigured firewall rule that allows any IP to access the database directly — a classic 'defense in depth' failure where the network layer control was missing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correct the firewall rule to restrict database access to only the application servers.
The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Correct the firewall rule to restrict database access to only the application servers.
Why this is correct
Directly addresses the misconfiguration that allowed exposure.
- ✗
Redesign the network architecture to place the database in a separate subnet.
Why it's wrong here
Long-term solution, not immediate.
- ✗
Block the external IP address at the network perimeter.
Why it's wrong here
Temporary measure; attacker can change IP.
- ✗
Apply a security patch to the web application to enforce HTTPS.
Why it's wrong here
Does not address the database access issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?
medium- A.Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.
- B.Notify the appropriate data protection authority within the required 72-hour timeframe.
- C.Patch the Oracle database server to the latest version to close any known vulnerabilities.
- ✓ D.Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.
Why D: The immediate priority is containment. Isolating DB-SRV-01 from the internal network prevents the attacker from moving laterally to other systems and stops further data exfiltration. Quarantining outbound traffic alone is insufficient as the server still has internal connectivity. Option A is incorrect because restoring from a backup would destroy forensic evidence and does not address the compromised IAM key for the S3 bucket. Option B is incorrect because notifying the data protection authority is a legal obligation that should follow containment and preservation of evidence. Option C is incorrect because patching the server does not address the active compromise and could also destroy evidence.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.