CISM Practice Question: During incident response, a team discovers that a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disable the user account

  Why this is correct

  Disabling the account immediately revokes the compromised credentials' ability to authenticate, cutting off the attacker's access path while investigation continues. This contains the breach at its entry point, preventing lateral movement or further data theft using that identity.

• ✗

  Restore the user's system from a backup

  Why it's wrong here

  Restoring from backup recovers files but leaves the compromised credentials valid, so the attacker retains access. It is tempting as ransomware recovery, where restoring clean data is the correct response, but here credential revocation and session invalidation are needed first.

• ✗

  Block the sender's IP address at the firewall

  Why it's wrong here

  Blocking the sender's IP at the firewall stops only that source; the attacker already holds valid credentials and can authenticate from any address. It is tempting because IP blocking is a routine containment control for ongoing external attacks, and would be correct against brute-force or scanning traffic rather than a successful credential compromise.

• ✗

  Change all user passwords

  Why it's wrong here

  Resetting every user's password is disruptive and does not revoke the attacker's active session tokens or refresh tokens, so the compromised account remains usable. It is tempting because bulk credential rotation is a standard remediation after confirmed credential theft, but it belongs to eradication and recovery, not immediate containment of the phishing foothold.

Go deeper

Related to this question