mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A company's incident response team uses a SIEM to…
A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?
⚠ Common exam trap
Candidates often confuse 'real-time alerting' (a notification feature) with 'detection capability,' assuming that speed of notification is more important than the logic that determines what constitutes an incident, but CISM emphasizes that detection effectiveness depends on the rule logic, not the alerting speed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlation rules
Correlation rules are the most critical SIEM capability for early detection because they allow the incident response team to define specific patterns of activity (e.g., multiple failed logins followed by a successful login from a different geographic location) that indicate a potential security incident. Unlike raw log review or simple alerting, correlation rules reduce false positives by combining multiple data sources and time-based conditions, enabling the SIEM to identify complex attack chains at the earliest possible stage. Without correlation, the team would rely on manual log analysis or isolated alerts, which significantly delays detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Correlation rules
Why this is correct
Correlation rules link related events across sources to detect attacks early.
- ✗
Real-time alerting
Why it's wrong here
Alerting is useful but only as good as the rules that trigger it.
- ✗
User and entity behavior analytics (UEBA)
Why it's wrong here
UEBA is advanced but not the most critical for basic early detection.
- ✗
Long-term log retention
Why it's wrong here
Retention helps forensics but not early detection.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?
medium- A.Hire additional security analysts to manually correlate logs
- B.Increase the amount of logging on all systems
- ✓ C.Implement a Security Information and Event Management (SIEM) system
- D.Reduce log retention to lower storage costs
Why C: A SIEM system is the primary improvement because it aggregates and correlates security logs from diverse sources in real time, enabling automated detection of patterns like ransomware propagation that manual or siloed logging cannot achieve. By normalizing log formats and applying correlation rules, a SIEM reduces detection latency and provides actionable alerts, directly addressing the identified gap in log correlation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.