CISM Information Security Program Practice Question
Exhibit
Refer to the exhibit.
Exhibit:
```
{
"securityControls": {
"firewall": {
"state": "active",
"rules": [
{"action": "allow", "src": "any", "dst": "web-servers", "port": 443},
{"action": "allow", "src": "web-servers", "dst": "db-servers", "port": 3306},
{"action": "deny", "src": "any", "dst": "any", "port": "any"}
]
},
"intrusionDetection": {
"state": "active",
"signatures": ["critical", "high"],
"action": "alert"
},
"vendorBaseline": "CIS Level 1"
}
}
```
This JSON policy is for a web application environment. The db-servers network is considered internal.Based on the exhibit, what is the most significant security gap in this configuration?
⚠ Common exam trap
ISACA often tests the distinction between IDS (alert-only) and IPS (inline blocking) to catch candidates who assume any detection system can automatically stop attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The intrusion detection system is set to alert-only, so it cannot block attacks.
The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The intrusion detection system is set to alert-only, so it cannot block attacks.
Why this is correct
Without prevention, attacks may succeed before manual response.
- ✗
The vendor baseline is CIS Level 1, which may be too permissive.
Why it's wrong here
Level 1 is a reasonable starting point; not the most significant gap compared to IDS action.
- ✗
The firewall allows inbound HTTPS from any source to web servers.
Why it's wrong here
This is necessary for public web access; not a gap.
- ✗
The database port 3306 is exposed to web servers without encryption.
Why it's wrong here
While encryption is not specified, the primary gap is the IDS not blocking; also, internal traffic encryption may be less critical.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.