mediumMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident, the incident response team…
During an incident, the incident response team discovers that the attacker used stolen credentials to access the network. What should the team do during the eradication phase?
⚠ Common exam trap
Watch out — candidates often confuse containment actions (like blocking IPs or isolating systems) with eradication steps, failing to recognize that stolen credentials require invalidating the authentication method itself, not just the network-level access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reset all user passwords.
Resetting all user passwords (option D) is the correct action during the eradication phase because the attacker used stolen credentials, meaning the compromised accounts remain a backdoor even after the initial threat is contained. Eradication requires removing all traces of the attacker's access, and password reset ensures that stolen hashes or plaintext credentials are no longer valid, preventing re-entry via the same authentication vector. This aligns with NIST SP 800-61 guidance on eliminating attacker footholds by invalidating compromised authentication tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a security awareness training.
Why it's wrong here
Incorrect: Preventive, not eradication.
- ✗
Block the attacker's IP addresses.
Why it's wrong here
Incorrect: Containment, not eradication; IPs can be changed.
- ✗
Install additional antivirus software.
Why it's wrong here
Incorrect: Not an eradication action for stolen credentials.
- ✓
Reset all user passwords.
Why this is correct
Correct: Directly removes attacker's access.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.