easyMultiple Choice
CISM A company's IDS alerts on a potential breach Practice Question
A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?
⚠ Common exam trap
Watch out — candidates often confuse 'immediate response' with 'containment' and choose a drastic action like disconnecting cables, forgetting that verification and scope assessment must precede any containment to avoid destroying evidence and causing unnecessary downtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the alert and assess scope
The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify the alert and assess scope
Why this is correct
Verifying the alert and assessing scope confirms whether the IDS detection is a genuine compromise and determines which systems are affected. Acting on unvalidated alerts risks wasted containment effort, while scope assessment directs subsequent containment, eradication and recovery priorities.
- ✗
Disconnect all network cables
Why it's wrong here
Pulling cables destroys volatile evidence such as memory-resident malware and active sessions, and disrupts containment decisions that should follow triage. Physical isolation is tempting because it halts spread instantly, and would be correct for a confirmed, fast-moving worm on a flat, unsegmented network where logical containment is impossible.
- ✗
Notify law enforcement
Why it's wrong here
Law enforcement notification is an external escalation that follows internal triage, containment and evidence preservation, and premature contact can compromise the investigation. It is tempting because breach notification feels urgent, and would be correct once the incident is confirmed and legal or regulatory obligations require disclosure.
- ✗
Reimage affected systems
Why it's wrong here
Reimaging destroys evidence and should be done only after investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.