mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An information security manager for a global…
You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.
The immediate priority is containment. Isolating DB-SRV-01 from the internal network prevents the attacker from moving laterally to other systems and stops further data exfiltration. Quarantining outbound traffic alone is insufficient as the server still has internal connectivity. Option A is incorrect because restoring from a backup would destroy forensic evidence and does not address the compromised IAM key for the S3 bucket. Option B is incorrect because notifying the data protection authority is a legal obligation that should follow containment and preservation of evidence. Option C is incorrect because patching the server does not address the active compromise and could also destroy evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.
Why it's wrong here
Restoring from backup would destroy the live system state needed for forensic investigation and does not address the active S3 bucket access; changing keys is necessary but not the first step.
- ✗
Notify the appropriate data protection authority within the required 72-hour timeframe.
Why it's wrong here
Notification is a legal step but is not an immediate containment action; the first priority is to stop the bleeding, not to report it.
- ✗
Patch the Oracle database server to the latest version to close any known vulnerabilities.
Why it's wrong here
Patching is important but should come after containment and forensic preservation; applying patches without understanding the attack vector may destroy evidence and not stop the active compromise.
- ✓
Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.
Why this is correct
Isolating the server halts any ongoing data exfiltration and prevents the attacker from moving laterally to other systems. This preserves the system state for forensic analysis while containing the breach.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.