CISM Incident Management Practice Question
After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Supply chain
Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insider threat
Why it's wrong here
The vendor is not an insider; insider threat refers to employees or contractors.
- ✗
Account compromise
Why it's wrong here
While credentials were compromised, the broader context involves a third-party vendor, making it a supply chain incident.
- ✓
Supply chain
Why this is correct
Incidents originating from a third-party vendor's environment are classified as supply chain incidents.
- ✗
DDoS
Why it's wrong here
DDoS involves overwhelming resources, not credential-based access.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.