hardMultiple ChoiceObjective-mapped
CISM Practice Question: Is under a DDoS attack that is saturating their…
An organization is under a DDoS attack that is saturating their internet link. The incident response team needs to mitigate the attack. Which action should be taken first?
⚠ Common exam trap
The trap here is that when the link is saturated, only an upstream cloud-based service can absorb the volume before it reaches the organization's infrastructure. Rate limiting or null-routing are not effective first steps because the attack traffic is already overwhelming the link.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activate cloud-based DDoS mitigation services.
Activating cloud-based DDoS mitigation services is the correct first step because these services are designed to absorb and scrub volumetric attacks at the network edge, before traffic reaches the saturated internet link. This preserves legitimate traffic while filtering malicious packets, which is critical when the link itself is overwhelmed and on-premises devices cannot process the volume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Activate cloud-based DDoS mitigation services.
Why this is correct
Correct: Scalable and effective.
- ✗
Shut down all public-facing services.
Why it's wrong here
Incorrect: Drastic and impacts business.
- ✗
Implement rate limiting on the perimeter firewall.
Why it's wrong here
Incorrect: May not handle volumetric attacks.
- ✗
Contact the ISP to null-route the attack IPs.
Why it's wrong here
Incorrect: Null-routing also blocks legitimate traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.