mediumMultiple ChoiceObjective-mapped
CISM Practice Question: Refer to the exhibit
Exhibit
[IDS Alert] Signature: ET TROJAN Known Botnet C2 1 Source: 10.0.1.50:443 -> Destination: 203.0.113.5:8080 Payload: [encrypted]
Refer to the exhibit. An analyst sees this alert on the network. What is the most appropriate immediate action?
⚠ Common exam trap
Many exam-takers choose to block the destination IP (Option D) thinking it stops the attack, but CISM emphasizes that the immediate priority is to investigate and contain the compromised host, not just disrupt the network-level indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the source endpoint for compromise
The alert indicates a potential command-and-control (C2) communication, likely involving a beaconing pattern to an external IP. Investigating the source endpoint for compromise is the most appropriate immediate action because it allows the incident responder to determine if the host is actively compromised, collect forensic evidence, and contain the threat before it escalates. Blocking IPs prematurely could destroy evidence or alert the attacker, while ignoring the alert risks missing a confirmed breach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the alert as it is likely false positive
Why it's wrong here
Ignoring could miss a real incident; the alert should be verified.
- ✓
Investigate the source endpoint for compromise
Why this is correct
Correct: The internal system is likely compromised and needs examination.
- ✗
Block the source IP 10.0.1.50
Why it's wrong here
Blocking the internal IP may disrupt legitimate services without investigation.
- ✗
Block the destination IP 203.0.113.5
Why it's wrong here
Blocking the external IP may help but immediate response should focus on internal.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.