hardMultiple SelectObjective-mapped
CISM Practice Question: A security team detects lateral movement within…
A security team detects lateral movement within the network using PowerShell scripts. Which TWO actions are MOST effective to contain the threat?
⚠ Common exam trap
CISM emphasizes the distinction between containment and remediation. The trap here is that candidates confuse 'isolating affected systems' (which is correct) with 'applying patches' (which is remediation, not containment), or they mistakenly think memory forensics is a containment action when it is actually part of the investigation phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable PowerShell remoting on all systems.
Disabling PowerShell remoting (WinRM) on all systems is a highly effective containment action because it directly cuts off the primary channel used for lateral movement via PowerShell scripts. Attackers frequently abuse WinRM (port 5985/5986) and PowerShell's `Invoke-Command` or `Enter-PSSession` to move laterally, so disabling this service blocks that specific attack vector without requiring immediate system isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct memory forensics on affected endpoints.
Why it's wrong here
Investigation, not containment.
- ✗
Implement network segmentation to isolate affected VLANs.
Why it's wrong here
Broad and slower than immediate isolation.
- ✓
Disable PowerShell remoting on all systems.
Why this is correct
Prevents further use of PowerShell for lateral movement.
- ✗
Apply the latest security patches to all systems.
Why it's wrong here
Eradication step, not containment.
- ✓
Isolate the affected systems immediately.
Why this is correct
Directly stops lateral movement from compromised hosts.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.