mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A security operations center analyst receives an…
A security operations center analyst receives an alert from the SIEM indicating a possible data exfiltration. The analyst is unsure if it is a true positive. What is the MOST appropriate action?
⚠ Common exam trap
Watch out — candidates often confuse 'immediate containment' (a later step in incident response) with 'initial validation,' leading them to choose a disruptive action like blocking or quarantining before confirming the alert is a true positive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review additional logs to confirm
The analyst must first validate the alert by reviewing additional logs (e.g., firewall, proxy, DNS, or endpoint logs) to confirm whether the SIEM alert represents a true positive. Jumping to containment or escalation without confirmation risks unnecessary disruption and false alarms, which violates the incident response principle of 'verify before acting.' The SIEM may have triggered on a benign pattern (e.g., a large file transfer to a trusted cloud service), and only correlated log analysis can establish intent and context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review additional logs to confirm
Why this is correct
Reviewing additional logs provides context and helps confirm whether the alert represents a true incident.
- ✗
Escalate to the incident response manager
Why it's wrong here
Escalation should occur after the incident is confirmed; the analyst should first verify the alert.
- ✗
Immediately block the source IP
Why it's wrong here
Blocking the source IP may disrupt legitimate traffic and is premature without confirmation.
- ✗
Quarantine the affected system
Why it's wrong here
Quarantining a system is a containment action that should be taken only after the incident is validated.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.