The correct sequence is that the attacker compromised jsmith's credentials, established command-and-control (C2), and exfiltrated data. This ordering aligns with the cyber kill chain, where initial access via credential compromise enables C2 beaconing for persistent remote control, followed by the final objective of data exfiltration. On the CISM exam, incident sequence analysis questions test your ability to reconstruct an attack timeline from disparate alerts, often using a brute-force login, an outbound beacon, and a large data transfer as the telltale pattern. A common trap is misordering the C2 and exfiltration steps, but remember that C2 must be established before data can be moved out. For a memory tip, think of the mnemonic "ACE" — Access, C2, Exfiltrate — to lock in the correct kill-chain progression.
CISM Incident Management Practice Question
This CISM practice question tests your understanding of incident management. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
---
Incident Log:
[2025-03-20 08:15:23] ALERT: Multiple failed logins for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:16:01] ALERT: Successful login for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:20:45] ALERT: Unusual outbound connection from host 10.0.0.45 to 198.51.100.10:4444
[2025-03-20 08:22:30] ALERT: Large data transfer from host 10.0.0.45 to 198.51.100.10
---
Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Refer to the exhibit.
---
Incident Log:
[2025-03-20 08:15:23] ALERT: Multiple failed logins for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:16:01] ALERT: Successful login for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:20:45] ALERT: Unusual outbound connection from host 10.0.0.45 to 198.51.100.10:4444
[2025-03-20 08:22:30] ALERT: Large data transfer from host 10.0.0.45 to 198.51.100.10
---
A
Insider threat: jsmith intentionally exfiltrated data
Why wrong: Failed logins suggest compromise, not intentional action.
B
Attacker compromised jsmith's credentials, established C2, and exfiltrated data
Pattern matches credential compromise, C2, and exfiltration.
C
Network scan from 10.0.0.45 triggered false positives
Why wrong: Data transfer indicates exfiltration, not scan.
D
Malware downloaded on jsmith's workstation and exfiltrated data
Why wrong: No download alert; failed logins indicate credential attack.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attacker compromised jsmith's credentials, established C2, and exfiltrated data
The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Insider threat: jsmith intentionally exfiltrated data
Why it's wrong here
Failed logins suggest compromise, not intentional action.
✓
Attacker compromised jsmith's credentials, established C2, and exfiltrated data
Why this is correct
Pattern matches credential compromise, C2, and exfiltration.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Network scan from 10.0.0.45 triggered false positives
Why it's wrong here
Data transfer indicates exfiltration, not scan.
✗
Malware downloaded on jsmith's workstation and exfiltrated data
Why it's wrong here
No download alert; failed logins indicate credential attack.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISACA often tests the distinction between a network scan and a targeted credential attack; the trap here is that candidates see the same source IP (10.0.0.45) and assume it's a scan, but the specific sequence of authentication failures followed by C2 and exfiltration indicates a successful compromise, not a reconnaissance scan.
Detailed technical explanation
How to think about this question
Under the hood, the C2 beacon often uses DNS tunneling or HTTPS to evade detection, where the beacon interval and packet sizes are tuned to blend with normal traffic. In this scenario, the external IP 10.0.0.45 is likely a public-facing server (not a private IP, which is a common misdirection in exam questions), and the authentication failures might be against a VPN or web portal using protocols like RADIUS or LDAP. Real-world attacks like the 2020 SolarWinds compromise used similar patterns: initial credential theft, stealthy C2 via modified HTTP headers, and delayed exfiltration to avoid triggering thresholds.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Incident Management — This question tests Incident Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Attacker compromised jsmith's credentials, established C2, and exfiltrated data — The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.
What should I do if I get this CISM question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.