hardMultiple ChoiceObjective-mapped
CISM Practice Question: Based on the exhibit, what is the MOST likely…
Exhibit
Refer to the exhibit. Exhibit: Firewall Log: Date Time Source IP Destination IP Port Protocol Action 2023-10-05 10:00:00 10.0.0.15 203.0.113.5 443 TCP ALLOW 2023-10-05 10:01:00 10.0.0.15 203.0.113.5 443 TCP ALLOW 2023-10-05 10:02:00 10.0.0.15 203.0.113.5 443 TCP ALLOW ... (repeated every minute) 2023-10-05 12:00:00 10.0.0.15 203.0.113.5 443 TCP ALLOW IDS Alert: Signature: ET TROJAN Win32/Malicious Beacon Source IP: 10.0.0.15 Destination IP: 203.0.113.5 Time: 2023-10-05 10:00:00 Severity: High
Based on the exhibit, what is the MOST likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system is infected with malware that is beaconing to a command and control server.
The IDS alert indicates a malware beacon, and the firewall log shows periodic outbound connections to an external IP, which is typical of command and control traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A system is infected with malware that is beaconing to a command and control server.
Why this is correct
The combination of IDS alert and periodic connections is indicative of C2 activity.
- ✗
A user is streaming video from a legitimate site.
Why it's wrong here
Streaming would not trigger a malware beacon alert.
- ✗
A software update is being downloaded from an external site.
Why it's wrong here
Software updates are not typically periodic every minute and would not trigger such an alert.
- ✗
A network scan is being performed from the internal IP.
Why it's wrong here
A scan would show multiple destinations, not a single IP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.