hardMultiple ChoiceObjective-mapped
CISM Practice Question: A multinational financial institution uses a…
A multinational financial institution uses a third-party Managed Security Service Provider (MSSP) for 24/7 monitoring of its security infrastructure. During a targeted attack, the MSSP’s analysts detected anomalous activity on a critical server at 2:00 AM. However, due to the service level agreement (SLA) which allows up to 12 hours for notification of lower-priority incidents, the MSSP classified the incident as medium severity and did not notify the internal incident response team until 2:00 PM. By then, the attacker had exfiltrated sensitive customer data. The internal team is conducting a post-incident review. What is the PRIMARY issue that led to the delay?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SLA for notification of medium-severity incidents was too long
The primary issue was that the SLA stipulated a notification window of up to 12 hours for medium-severity incidents, which was too long given the potential for rapid data exfiltration. Even if the severity classification (medium) was technically correct based on the MSSP's guidelines, the SLA itself created an unacceptable delay. Option B (incorrect classification) may have contributed, but the root cause was the SLA's insufficient responsiveness for that severity level. Options A and C are not supported by the scenario: the MSSP analysts correctly detected the anomaly, and the internal team was presumably available when notified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The MSSP analysts lacked technical skills to recognize the incident's true severity
Why it's wrong here
The analysts detected the activity but followed SLA rules; skills are not the primary issue.
- ✗
The incident severity was incorrectly classified as medium
Why it's wrong here
Even if reclassified, the SLA might still cause delay; the main issue is the SLA duration.
- ✗
The internal incident response team was not available until 2:00 PM
Why it's wrong here
The team could have been called earlier if the SLA permitted.
- ✓
The SLA for notification of medium-severity incidents was too long
Why this is correct
The SLA allowed a 12-hour delay which was exploited by the attacker.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.