easyMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident, the CIRT leader decides to…
During an incident, the CIRT leader decides to contain a compromised server by disconnecting it from the network. However, this action may result in loss of volatile forensics data. What should the CIRT leader do?
⚠ Common exam trap
The trap here is that candidates may prioritize containment speed (Option A) over forensic preservation, forgetting that volatile data is irrecoverable once the system is powered off or disconnected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collect volatile data (memory, processes) before disconnecting
Volatile data (e.g., memory contents, running processes, network connections) is lost when power is removed or the network interface is disabled. The CIRT leader must follow the order of volatility (RFC 3227) and capture this data first to preserve forensic evidence before containment actions that alter the system state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Proceed with disconnection immediately to prevent further damage
Why it's wrong here
Volatile data loss may hinder investigation.
- ✗
Keep the server connected but block all inbound/outbound traffic
Why it's wrong here
Blocking traffic may not fully contain the threat if the server is already compromised.
- ✗
Perform a full disk imaging before disconnection
Why it's wrong here
Imaging is important but volatile data is lost if system is shut down.
- ✓
Collect volatile data (memory, processes) before disconnecting
Why this is correct
This preserves forensic evidence while allowing containment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.