CISM Practice Question: After containing a security incident, the team…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Increase logging on vendor accounts

  Why it's wrong here

  Increasing logging only improves visibility after the fact; it does not stop a compromised vendor account from being reused. It is tempting because detection feels like mitigation, but the long-term fix is reducing and governing third-party access through least privilege, MFA and periodic entitlement reviews.

• ✗

  Change all passwords manually

  Why it's wrong here

  Manually changing passwords is a one-off containment action that does not prevent recurrence; the compromised vendor account would be recreated with the same weak controls. It is tempting because credential rotation feels thorough, but the long-term mitigation is governing third-party access through least privilege, MFA and continuous monitoring.

• ✓

  Implement vendor access reviews and enforce MFA

  Why this is correct

  Vendor access reviews and enforced MFA address the compromised third-party credential vector directly, removing standing access and adding a possession factor that stolen passwords alone cannot satisfy. This is a durable governance and identity control, unlike one-off remediation, and satisfies the long-term mitigation requirement.

• ✗

  Terminate the vendor relationship

  Why it's wrong here

  Terminating the vendor removes the compromised account but abandons the service, and the same weak third-party access controls would recur with any replacement vendor. It is tempting as decisive remediation, yet the durable fix is enforcing least-privilege, MFA and monitoring over third-party identities rather than severing the business relationship.

Go deeper

Related to this question