mediumMultiple ChoiceObjective-mapped
CISM Practice Question: Based on the exhibit, which of the following is…
Exhibit
Refer to the exhibit. ``` [2025-03-10 14:32:15] CRITICAL: File integrity violation on /etc/passwd [2025-03-10 14:32:15] File: /etc/passwd, Expected hash: a1b2c3d4e5f6, Actual hash: 9z8y7x6w5v4u [2025-03-10 14:32:16] ALERT: Unauthorized SSH key added to /home/admin/.ssh/authorized_keys [2025-03-10 14:32:18] ALERT: New user 'backup_agent' created with UID 0 ```
Based on the exhibit, which of the following is the MOST likely attack vector?
⚠ Common exam trap
ISACA often tests the distinction between the initial infection vector (e.g., phishing) and the attack vector used for lateral movement (e.g., compromised credentials), leading candidates to confuse the method of initial access with the method of privilege escalation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privilege escalation via a compromised account
The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection attack
Why it's wrong here
No evidence of database compromise.
- ✓
Privilege escalation via a compromised account
Why this is correct
The logs show signs of root-level access.
- ✗
Phishing email with malicious attachment
Why it's wrong here
No evidence of email-based attack.
- ✗
Denial of service attack
Why it's wrong here
No indication of service disruption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.