CISM Information Security Program Practice Question
Exhibit
Refer to the exhibit. Exhibit: Network Architecture Description The network consists of three zones: External, DMZ, and Internal. The external interface connects to the internet. The DMZ hosts public-facing web servers and an email relay. The internal zone hosts database servers and application servers. A firewall separates External from DMZ, and another firewall separates DMZ from Internal. The firewall rules are: - External to DMZ: allow HTTP, HTTPS, SMTP. - DMZ to Internal: allow MySQL (3306) from web servers to database servers, and allow LDAP (389) from application servers to domain controllers. - Internal to External: allow outbound HTTP/HTTPS from application servers. - All other traffic is denied. The IDS is placed on the DMZ segment, monitoring traffic between DMZ and Internal. The IDS signatures include critical, high, and medium severity, and the action is 'alert and log'.
Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?
⚠ Common exam trap
CISM exams often test the concept that permitted traffic between zones (e.g., web to database) can be abused once an intermediate host is compromised, leading candidates to overlook the SQL injection vector in favor of more obvious but less specific attacks like DDoS or spam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.
The exhibit shows that MySQL traffic is permitted from the web server to the database server. An attacker who compromises the web server (e.g., via SQL injection) can use that allowed MySQL connection to extract sensitive data directly from the database, bypassing other network controls. This is a classic example of a trust-based vulnerability where internal database access is not sufficiently restricted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An attacker could perform a DDoS attack on the external interface to disrupt email services.
Why it's wrong here
Possible but not the most likely vulnerability; email may have mitigation.
- ✓
An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.
Why this is correct
The MySQL rule allows direct database access from web; SQL injection can leverage this.
- ✗
An attacker could exploit the SMTP service to send spam.
Why it's wrong here
Spam is not a data breach; less likely as a primary exploit.
- ✗
An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.
Why it's wrong here
LDAP is between application servers and domain controllers; not directly exploitable from external.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.