easyMultiple ChoiceObjective-mapped
CISM Practice Question: Refer to the exhibit
Exhibit
2025-04-09 10:30:00 192.168.1.10 -> 10.10.10.10:3306 (MySQL) - 10 connections 2025-04-09 10:30:05 192.168.1.10 -> 10.10.10.10:3306 - 20 connections 2025-04-09 10:30:10 192.168.1.10 -> 10.10.10.10:3306 - 50 connections 2025-04-09 10:30:15 192.168.1.10 -> 10.10.10.10:3306 - 100 connections
Refer to the exhibit. The exhibit shows network traffic from a server to a database. What does this pattern MOST likely indicate?
⚠ Common exam trap
CISM often tests the distinction between a performance issue (like query optimization) and a security incident (like SQL injection) by presenting traffic patterns that look similar to slow queries but contain telltale injection syntax, tricking candidates into choosing the benign option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection attempt
The exhibit shows a pattern of repeated SQL query-like strings in the network traffic, such as 'SELECT * FROM users WHERE id = 1 OR 1=1', which is a classic SQL injection payload. This indicates an attacker is attempting to manipulate the SQL query to bypass authentication or extract data, not a normal application load or performance issue. The sudden spike in similar requests with malicious syntax confirms an active SQL injection attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Query optimization issue
Why it's wrong here
Query optimization issues might cause slow queries but not a rapid increase in connection count.
- ✓
SQL injection attempt
Why this is correct
SQL injection tools often create many connections to execute queries, matching the pattern.
- ✗
Normal application load
Why it's wrong here
Normal load would show gradual changes, not such a rapid spike in connections.
- ✗
Database server crash
Why it's wrong here
A crash would result in no connections, not increasing connections.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.