CISM Information Security Program Practice Question
Exhibit
Refer to the exhibit. ``` [SYN] 12:01:00.001 192.168.1.10:12345 -> 10.0.0.1:80 [SYN-ACK] 12:01:00.002 10.0.0.1:80 -> 192.168.1.10:12345 [ACK] 12:01:00.003 192.168.1.10:12345 -> 10.0.0.1:80 [GET /index.html] 12:01:00.004 192.168.1.10:12345 -> 10.0.0.1:80 [SYN] 12:01:00.005 192.168.1.11:23456 -> 10.0.0.1:80 [SYN-ACK] 12:01:00.006 10.0.0.1:80 -> 192.168.1.11:23456 [ACK] 12:01:00.007 192.168.1.11:23456 -> 10.0.0.1:80 [GET /login.php] 12:01:00.008 192.168.1.11:23456 -> 10.0.0.1:80 [SYN] 12:01:00.009 192.168.1.12:34567 -> 10.0.0.1:80 [SYN-ACK] 12:01:00.010 10.0.0.1:80 -> 192.168.1.12:34567 [ACK] 12:01:00.011 192.168.1.12:34567 -> 10.0.0.1:80 [GET /admin.php] 12:01:00.012 192.168.1.12:34567 -> 10.0.0.1:80 ```
Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?
⚠ Common exam trap
The trap here is that candidates may misinterpret any traffic from multiple hosts as a DDoS attack, failing to notice the normal handshake completion and low packet volume that indicate legitimate user access rather than an attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multiple users are accessing the web server normally.
The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A SYN flood attack is in progress.
Why it's wrong here
A SYN flood requires many half-open connections from spoofed or numerous sources; three internal hosts completing handshakes against one web server does not match that pattern. SYN flood detection is the answer when the exhibit shows a flood of unanswered SYN packets.
- ✗
A single host is using multiple IP addresses to scan the server.
Why it's wrong here
The exhibit shows three distinct hosts, not one host presenting multiple addresses, so the single-host scan interpretation contradicts the source count. That option would be correct if the capture showed one MAC or host generating traffic from several spoofed IP addresses.
- ✓
Multiple users are accessing the web server normally.
Why this is correct
Traffic from three internal hosts to one web server, using standard HTTP/HTTPS ports with normal request-response patterns and no scanning or spoofing signatures, indicates routine browsing. Multiple clients reaching the same server is expected behaviour, so the traffic reflects ordinary user access rather than an attack.
- ✗
A distributed denial-of-service (DDoS) attack is occurring.
Why it's wrong here
A DDoS attack involves a large, distributed set of sources overwhelming a target; three internal hosts do not constitute a distributed botnet. DDoS interpretation is correct when the exhibit shows traffic from many external, geographically dispersed addresses, not a small internal set.
Visual reference
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.