hardMultiple ChoiceObjective-mapped
CISM Practice Question: During a security incident, the incident response…
During a security incident, the incident response team discovers that an attacker has exfiltrated data via an encrypted tunnel over HTTPS. Which log source is MOST likely to provide evidence of the exfiltration?
⚠ Common exam trap
Test-takers frequently choose firewall logs or IDS logs because they think network-level logs will show the exfiltration, but they forget that HTTPS encryption hides the application-layer details, making proxy logs (with SSL inspection) the only reliable source for evidence of the exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Proxy logs
Proxy logs are the most likely source because they can record the full URL and HTTP headers of HTTPS requests, including the destination host and path, even though the payload is encrypted. Since the attacker exfiltrated data over an encrypted tunnel, the proxy log can show the outbound connection to the command-and-control server or data storage endpoint, providing evidence of the exfiltration activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web server access logs
Why it's wrong here
Server logs may not capture outbound connections from that server.
- ✗
Firewall logs
Why it's wrong here
Firewall logs show connections but not the data volume per session.
- ✗
Intrusion detection system (IDS) logs
Why it's wrong here
IDS may not decrypt encrypted traffic to see content.
- ✓
Proxy logs
Why this is correct
Proxy logs can show all HTTPS traffic, including destinations and data sizes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.