CISM Practice Question: That their computer is behaving oddly, and an IT…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Document the findings and continue monitoring

  Why it's wrong here

  Documenting and merely monitoring delays escalation; the technician must first report the suspicious startup file through the incident response process so it can be triaged. It is tempting because documentation is part of response, but it is the correct action after triage, not before determining whether an incident exists.

• ✓

  Escalate to the security team

  Why this is correct

  A suspicious file in the startup folder is a potential indicator of compromise requiring specialist triage, so the technician should escalate to the security team immediately. Preserving evidence and avoiding independent containment actions supports the incident response process.

• ✗

  Run an antivirus scan

  Why it's wrong here

  Running an antivirus scan assumes the file is already identified as malware, but the technician is uncertain whether the file constitutes an incident at all. The correct first step is to preserve the file for forensic analysis and check its digital signature, hash, or behaviour in a sandbox to determine if it is malicious. This option is tempting because antivirus software is the standard tool for removing known threats, and it would be correct if the technician had already confirmed the file was malware and needed to remediate.

• ✗

  Delete the suspicious file

  Why it's wrong here

  Deleting the file destroys volatile evidence before the incident response process determines whether it is malicious, hindering investigation and containment. It is tempting as quick remediation, and deletion would be right after an incident is confirmed and evidence preserved, not as the first uncertain step.