CISM Incident Management Practice Question
A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?
⚠ Common exam trap
Watch out — candidates often confuse the method of access (account compromise) with the outcome (data breach), but CISM distinguishes incidents by the root cause and attack vector, not just the potential impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Account compromise
The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data breach
Why it's wrong here
Data breach is confirmed only if data is exfiltrated; this is an access incident.
- ✗
Physical security
Why it's wrong here
There is no physical security element.
- ✓
Account compromise
Why this is correct
The key action is unauthorized use of credentials, which is account compromise.
- ✗
Insider threat
Why it's wrong here
The scenario does not indicate the employee is an insider; credentials could be stolen by an external actor.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.