mediumMultiple ChoiceObjective-mapped
CISM Practice Question: Given the exhibit, what is the most likely…
Exhibit
Refer to the exhibit. Alert: 'Elevated number of failed logins from IP 10.0.0.5 to multiple user accounts on Domain Controller.' Time: 2025-03-01 14:23:45 Additional details: 50 failed attempts in 30 seconds.
Given the exhibit, what is the most likely classification of this incident?
⚠ Common exam trap
Candidates often confuse a high volume of failed logins with a denial of service attack, but the key distinction is that brute-force attacks focus on authentication attempts rather than overwhelming system resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute-force attack
The exhibit shows a high volume of failed authentication attempts (e.g., repeated 'Login failed' events) from a single external IP address targeting multiple user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries password combinations to gain unauthorized access. The incident classification is based on the specific behavior of repeated login failures, not on malware signatures or traffic flooding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Malware infection
Why it's wrong here
Incorrect: No indication of malware.
- ✗
Denial of service
Why it's wrong here
Incorrect: DoS would target service availability, not auth attempts.
- ✓
Brute-force attack
Why this is correct
Correct: Typical pattern of brute-force password guessing.
- ✗
Insider threat
Why it's wrong here
Incorrect: No evidence of insider activity.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.