hardMultiple SelectObjective-mapped
Alert Verification and Correlation — Key First Steps in Incident Response
A security analyst reviews the following alert from the SIEM: 'Multiple failed login attempts from IP 10.0.0.5 to the domain controller within 5 minutes.' Which TWO actions should the analyst take as part of initial incident response?
Quick Answer
The correct answer is to check if the source IP belongs to an internal asset and to review authentication logs from other servers for similar patterns. These two actions are essential because alert verification in incident response requires distinguishing between a genuine external threat and a misconfigured internal system, while correlation across multiple servers helps determine if the failed login attempts are part of a broader brute-force or password-spraying campaign. On the CISM exam, this tests your ability to apply the initial response phase of the incident response process, specifically scoping and validation before escalation. A common trap is jumping to containment or blocking the IP without first verifying ownership and lateral spread. Remember the memory tip: “Verify the source, then check the course” — confirm the IP’s origin, then look for the same pattern across other systems to gauge true scope.
⚠ Common exam trap
Test-takers frequently confuse immediate containment (blocking the IP) with proper triage, failing to recognize that validating the source IP's ownership and correlating logs across systems are essential first steps before any irreversible action is taken.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review authentication logs from other servers for similar patterns.
Reviewing authentication logs from other servers for similar patterns helps determine if the failed login attempts are part of a broader brute-force or password-spraying attack targeting multiple systems, not just the domain controller. This lateral analysis is a key initial step in incident response to assess the scope and identify compromised accounts or additional indicators of compromise (IoCs). Option E is correct because verifying whether the source IP belongs to an internal asset is critical to distinguish between an external attacker and a misconfigured internal service or user, which directly impacts the response strategy (e.g., internal remediation vs. external threat containment).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the IP address in the firewall immediately.
Why it's wrong here
Blocking without confirmation may disrupt legitimate traffic.
- ✓
Review authentication logs from other servers for similar patterns.
Why this is correct
Correlation helps identify a broader attack.
- ✗
Escalate the alert to the incident response team.
Why it's wrong here
Escalation may be needed but not the first two actions.
- ✗
Reset the password of the targeted account.
Why it's wrong here
Password reset is premature without confirming account compromise.
- ✓
Check if the source IP belongs to an internal asset.
Why this is correct
Determining the source helps assess the scope.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security operations center (SOC) analyst receives an alert from the SIEM indicating a potential command and control (C2) communication. The alert is based on a signature that matches known C2 traffic. What is the MOST appropriate next step?
hard- A.Block the destination IP address at the firewall
- B.Escalate the alert to the incident response team immediately
- ✓ C.Verify the alert by correlating with other log sources
- D.Perform a full antivirus scan on all endpoints
Why C: Verifying the alert by checking other log sources (e.g., firewall, DNS) reduces false positives before escalating. Escalating immediately (B) may waste resources if the alert is a false positive. Blocking the IP address at the firewall (A) could be premature if the traffic is legitimate. Running a full antivirus scan on all endpoints (D) is a reactive step that does not address the immediate investigation of the alert.
Variation 2. A security analyst receives an alert indicating a potential data exfiltration from a server. Which of the following should be the FIRST step in the incident response process?
easy- A.Perform a forensic analysis.
- B.Escalate to senior management.
- C.Isolate the server from the network.
- ✓ D.Verify the alert to confirm it is not a false positive.
Why D: The first step in the incident response process is to verify the alert to confirm it is not a false positive. Prematurely isolating the server or escalating without validation can disrupt legitimate operations and waste resources. Verification ensures that the incident response team acts on confirmed threats, aligning with the NIST SP 800-61 incident response lifecycle's detection and analysis phase.
Variation 3. Refer to the exhibit. An analyst sees this alert on the network. What is the most appropriate immediate action?
medium- A.Ignore the alert as it is likely false positive
- ✓ B.Investigate the source endpoint for compromise
- C.Block the source IP 10.0.1.50
- D.Block the destination IP 203.0.113.5
Why B: The alert indicates a potential command-and-control (C2) communication, likely involving a beaconing pattern to an external IP. Investigating the source endpoint for compromise is the most appropriate immediate action because it allows the incident responder to determine if the host is actively compromised, collect forensic evidence, and contain the threat before it escalates. Blocking IPs prematurely could destroy evidence or alert the attacker, while ignoring the alert risks missing a confirmed breach.
Variation 4. A security operations center receives an alert from an IDS indicating possible command and control traffic. The analyst is unsure if it's a true positive. Which combination of actions should be taken first?
hard- A.Disable the IDS signature to prevent further alerts.
- B.Immediately block the source IP and escalate to the incident response team.
- C.Conduct a full forensic analysis of the affected host.
- ✓ D.Correlate the alert with firewall and proxy logs and review threat intelligence.
Why D: The first step in validating a potential command and control (C2) alert is to correlate the IDS event with other network logs (e.g., firewall, proxy) and threat intelligence. This helps confirm whether the traffic matches known C2 patterns (e.g., beaconing intervals, unusual DNS queries) before taking any disruptive action. Premature blocking or forensic analysis without correlation risks false positives or missing context.
Variation 5. A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?
easy- ✓ A.Verify the alert and assess scope
- B.Disconnect all network cables
- C.Notify law enforcement
- D.Reimage affected systems
Why A: The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.