hardMultiple ChoiceObjective-mapped
CISM Practice Question: After a phishing attack, an organization's…
After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?
⚠ Common exam trap
Many candidates choose 'Reset all user passwords' thinking it is a comprehensive security measure, but it fails to immediately terminate the attacker's active session and can cause operational chaos, whereas disabling the compromised account is the precise, immediate containment step required in incident response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the compromised account
Disabling the compromised account immediately stops the attacker from using the authenticated session to send further internal spear-phishing emails. This containment action directly cuts off the attacker's foothold within the email system, preventing lateral movement and further compromise of other users. It is the fastest way to halt the ongoing attack without disrupting the entire user base.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable the compromised account
Why this is correct
Immediately disabling the account stops further abuse.
- ✗
Reset all user passwords
Why it's wrong here
Resetting all passwords is disruptive and not targeted.
- ✗
Block the attacker's IP address at the firewall
Why it's wrong here
The attacker is using a legitimate internal account, not an external IP.
- ✗
Increase email filtering rules
Why it's wrong here
Internal emails may bypass filtering.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.