mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A large e-commerce company detects a…
A large e-commerce company detects a sophisticated attack that has compromised a web application server. The server contains customer payment card information. The incident response team is activated. During triage, the team discovers that the attacker has gained administrative access and installed a backdoor. The company's public relations department wants to issue a press release as soon as possible to maintain customer trust. Legal counsel advises that the breach must be reported to regulators within 72 hours. The technical team is working on containment. What is the MOST important priority for the incident manager at this point?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Focus on containing the breach and eradicating the threat before any disclosure.
The primary responsibility of the incident manager during an active breach is to contain the threat and prevent further damage. While forensic investigation (Option A) is important, it can be conducted after containment. Reporting to regulators (Option B) must occur within 72 hours, but containment takes precedence to prevent additional data loss. Authorizing a press release (Option D) could compromise containment efforts and legal strategy. Therefore, focusing on containment and eradication (Option C) is the most important priority.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a thorough forensic investigation to determine the full extent of the breach before taking action.
Why it's wrong here
Delays containment; investigation can proceed in parallel.
- ✗
Immediately report the breach to regulators to comply with the 72-hour requirement.
Why it's wrong here
Reporting can be done after assessment and containment.
- ✓
Focus on containing the breach and eradicating the threat before any disclosure.
Why this is correct
Containment stops further damage; communication follows.
- ✗
Authorize the press release to manage public perception.
Why it's wrong here
Premature disclosure without understanding scope can worsen reputation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.