mediumMultiple Choice
CISM Practice Question: An organization's incident response team has…
An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?
⚠ Common exam trap
Candidates often think increasing logging (Option B) is sufficient, but without correlation, more logs simply create more noise and do not improve detection speed or accuracy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Security Information and Event Management (SIEM) system
A SIEM system is the primary improvement because it aggregates and correlates security logs from diverse sources in real time, enabling automated detection of patterns like ransomware propagation that manual or siloed logging cannot achieve. By normalizing log formats and applying correlation rules, a SIEM reduces detection latency and provides actionable alerts, directly addressing the identified gap in log correlation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hire additional security analysts to manually correlate logs
Why it's wrong here
Manual correlation by extra analysts does not address the underlying gap: logs from disparate systems remain uncorrelated, so detection still depends on human review speed. It is tempting because adding headcount is a familiar remediation, and would suit environments where analyst-led triage of a small, well-understood log estate is genuinely required.
- ✗
Increase the amount of logging on all systems
Why it's wrong here
Volume of logging does not address correlation; more uncorrelated data increases noise and analyst workload. The gap is aggregation and correlation across sources, which a SIEM provides. Increasing logging is tempting because it feels thorough, and it would be correct if the review had found that relevant events were simply never recorded.
- ✓
Implement a Security Information and Event Management (SIEM) system
Why this is correct
A SIEM correlates and analyses log events across disparate systems in real time, directly addressing the delayed detection caused by uncorrelated logs. It satisfies the stem's constraint by providing centralised correlation and alerting, which point solutions or manual review cannot achieve at scale.
- ✗
Reduce log retention to lower storage costs
Why it's wrong here
Cutting log retention removes the historical data needed to correlate events across systems, worsening the delayed-detection problem rather than fixing it. It is tempting as a cost-control measure, and would be the right choice where regulatory or forensic requirements permit short retention and storage spend is the binding constraint.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.