mediumMultiple ChoiceObjective-mapped
CISM Practice Question: An organization's incident response team has…
An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?
⚠ Common exam trap
Candidates often think increasing logging (Option B) is sufficient, but without correlation, more logs simply create more noise and do not improve detection speed or accuracy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Security Information and Event Management (SIEM) system
A SIEM system is the primary improvement because it aggregates and correlates security logs from diverse sources in real time, enabling automated detection of patterns like ransomware propagation that manual or siloed logging cannot achieve. By normalizing log formats and applying correlation rules, a SIEM reduces detection latency and provides actionable alerts, directly addressing the identified gap in log correlation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hire additional security analysts to manually correlate logs
Why it's wrong here
Manual correlation is inefficient and not scalable; automation is needed.
- ✗
Increase the amount of logging on all systems
Why it's wrong here
More logs without correlation can overwhelm analysts and not solve the detection gap.
- ✓
Implement a Security Information and Event Management (SIEM) system
Why this is correct
SIEM correlates logs from multiple sources to detect incidents in a timely manner.
- ✗
Reduce log retention to lower storage costs
Why it's wrong here
Reducing retention would make historical analysis harder, not improve detection.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.