hardMultiple Choice
CISM Practice Question: During an incident investigation, the security…
During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?
⚠ Common exam trap
The trap here is that candidates may focus on the initial breach vector (e.g., unpatched software or weak passwords) rather than the detection failure that allowed the exfiltration to persist undetected for months, which is the core of the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inadequate monitoring of DNS traffic for anomalies
DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inadequate monitoring of DNS traffic for anomalies
Why this is correct
DNS tunnelling encodes exfiltrated data inside ordinary DNS queries, which most firewalls permit. Without anomaly detection on query volume, entropy, or unusual domains, this low-and-slow channel blends into normal resolution traffic, letting the attacker operate undetected for months.
- ✗
Weak password policies
Why it's wrong here
Weak password policies enable credential compromise, but the attacker tunnelled data out through DNS rather than authenticating with stolen credentials. Password hardening would not expose exfiltration hidden inside permitted DNS traffic. It is tempting because credential weakness is a common root cause, yet here the gap is DNS monitoring.
- ✗
Unpatched web server software
Why it's wrong here
Unpatched web server software permits initial compromise through known vulnerabilities, but the stem describes exfiltration continuing undetected for three months. Patching would not reveal DNS-tunnelled traffic. It is tempting because unpatched servers are a classic finding, yet the detection failure lies in monitoring DNS, not in patch management.
- ✗
Lack of data-at-rest encryption
Why it's wrong here
Data-at-rest encryption protects stored data if media is stolen or accessed directly; it does nothing to detect data already being transmitted outbound. The exfiltration occurred over the network via DNS, so encryption at rest is irrelevant. It is tempting because encryption is a frequent control gap, but the failure is outbound DNS inspection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.