hardMultiple ChoiceObjective-mapped
CISM Practice Question: A bank detects unusual activity on a server…
A bank detects unusual activity on a server containing sensitive financial data. The activity appears to be from a compromised vendor account that has legitimate remote access to the server for maintenance. The incident manager must decide on containment while maintaining business operations. The vendor account has elevated privileges and is used for routine updates. Disabling the account would delay critical maintenance. What is the BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the affected server from the network while allowing necessary access through a jump box.
The best course of action because it isolates the compromised server from the main network while still allowing legitimate vendor maintenance through a controlled jump box. This balances security and business continuity. Option A is ineffective as the vendor may be compromised or unaware. Option C is too disruptive and would halt critical updates. Option D is overly broad and could impact other necessary remote access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Contact the vendor to ask about the unusual activity.
Why it's wrong here
Alerts the attacker if vendor is already compromised; immediate containment needed.
- ✓
Isolate the affected server from the network while allowing necessary access through a jump box.
Why this is correct
Contains the threat while maintaining essential vendor access securely.
- ✗
Disable the vendor's account immediately.
Why it's wrong here
Disrupts critical maintenance; better to isolate first.
- ✗
Block all remote access from external IPs.
Why it's wrong here
May block legitimate remote access not related to the incident.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are key components of the 'Containment' phase in incident response?
medium- A.Restoring systems from backups
- ✓ B.Implementing temporary workarounds to stop damage
- C.Eradicating malware from infected systems
- D.Writing a final incident report
- ✓ E.Deploying patches or configuration changes to secure systems
Why B: Containment is the immediate priority in incident response to stop the spread of damage and prevent further compromise. Implementing temporary workarounds—such as isolating affected systems, blocking malicious IPs via firewall rules, or disabling compromised accounts—directly halts the incident's impact without waiting for full eradication or recovery. Option E is also correct because deploying patches or configuration changes can serve as a containment measure by closing the vulnerability that allowed the attack, thereby preventing the attacker from re-entering or continuing the exploit.
Variation 2. After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?
hard- ✓ A.Disable the compromised account
- B.Reset all user passwords
- C.Block the attacker's IP address at the firewall
- D.Increase email filtering rules
Why A: Disabling the compromised account immediately stops the attacker from using the authenticated session to send further internal spear-phishing emails. This containment action directly cuts off the attacker's foothold within the email system, preventing lateral movement and further compromise of other users. It is the fastest way to halt the ongoing attack without disrupting the entire user base.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.