mediumMultiple ChoiceObjective-mapped
CISM Practice Question: Based on the SIEM alert exhibit, which immediate…
Exhibit
Refer to the exhibit. ``` [Alert] Correlation Rule: Multiple Failed Logins Source IP: 10.0.0.55 Destination IP: 192.168.1.10 Event Count: 150 failed logins to admin account 'jsmith' within 5 minutes Action: Triggered ```
Based on the SIEM alert exhibit, which immediate action should the incident responder take?
⚠ Common exam trap
Many candidates choose to block the source IP, thinking it stops the attack, but fail to realize the attacker already has valid credentials and can pivot from any IP, making account lockout the only effective containment step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lock the user account 'jsmith'
The SIEM alert indicates a successful brute-force login from source IP 10.0.0.55 to the destination server using the account 'jsmith'. Locking the user account immediately stops the attacker from further exploiting the compromised credentials, which is the most direct containment action. Blocking the IP alone would not prevent re-authentication if the attacker switches IPs, and contacting the user wastes critical time during an active incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the source IP 10.0.0.55 at the firewall
Why it's wrong here
Blocking IP is good but may be a temporary measure; locking account is more direct.
- ✓
Lock the user account 'jsmith'
Why this is correct
Locking the account prevents further brute-force.
- ✗
Increase logging level for the destination server
Why it's wrong here
Increasing logging is not an immediate response.
- ✗
Contact the user 'jsmith' to verify activity
Why it's wrong here
Verification is important but not immediate; the attack is ongoing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.