mediumMultiple ChoiceObjective-mapped
CISM Practice Question: During a phishing campaign, several employees…
During a phishing campaign, several employees clicked a malicious link that downloaded a remote access trojan (RAT). The incident response team has isolated the infected endpoints and is analyzing network traffic. They suspect that data may have been exfiltrated but are unsure. The team needs to determine the extent of data exfiltration as quickly as possible. What action should the team take FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review DNS logs for outbound connections to unknown destinations
Reviewing DNS logs can reveal connections to known malicious domains or unusual patterns, helping identify data exfiltration. Blocking the domain is a containment step but doesn't aid analysis. Running a network scan may be too broad. Resetting passwords is important but not for detecting exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review DNS logs for outbound connections to unknown destinations
Why this is correct
DNS logs can show queries to command-and-control or exfiltration domains, providing evidence.
- ✗
Block the malicious domain at the firewall
Why it's wrong here
Blocking is containment; it does not help determine if exfiltration occurred.
- ✗
Reset all employees' passwords
Why it's wrong here
Password reset is a security measure but does not reveal exfiltration activity.
- ✗
Run a full network scan for open ports
Why it's wrong here
A network scan might find other issues but is not efficient for detecting specific exfiltration.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.