easyMultiple ChoiceObjective-mapped
CISM Practice Question: An organization's intrusion detection system…
An organization's intrusion detection system alerts on a potential C2 communication from an internal host. Which phase of the incident response lifecycle should be initiated first?
⚠ Common exam trap
A common misconception in CISM is that containment should be the immediate priority, but the trap here is that without first performing Detection and Analysis, you cannot accurately contain the threat, potentially allowing the attacker to pivot or destroy evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Detection and Analysis
When an IDS alerts on potential C2 communication, the organization must first verify the alert and determine the scope of the incident. The Detection and Analysis phase is the initial step in the incident response lifecycle, as defined by NIST SP 800-61, because it involves confirming the alert, analyzing indicators of compromise (IoCs), and assessing the severity before any containment actions are taken. Without proper detection and analysis, containment efforts could be misdirected or ineffective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Post-Incident Activity
Why it's wrong here
Post-incident is after recovery.
- ✗
Preparation
Why it's wrong here
Preparation is done before incidents occur.
- ✗
Containment, Eradication, and Recovery
Why it's wrong here
Containment occurs after analysis confirms an incident.
- ✓
Detection and Analysis
Why this is correct
Alert triggers the detection phase.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.