easyMultiple ChoiceObjective-mapped
CISM Practice Question: A security analyst receives an alert from the…
A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?
⚠ Common exam trap
It's easy for candidates to think notifying law enforcement is the first step, but CISM emphasizes immediate containment (blocking the IP) before escalation or external notification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the IP address at the firewall.
The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block the IP address at the firewall.
Why this is correct
Immediate containment stops ongoing attacks.
- ✗
Ignore the alert as it is likely a false positive.
Why it's wrong here
Ignoring risks a successful brute-force attack.
- ✗
Disable the web server.
Why it's wrong here
Too disruptive; blocking is sufficient.
- ✗
Notify law enforcement.
Why it's wrong here
Premature; not yet confirmed a major breach.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.