The correct first action is to isolate the database server from the network and block outbound traffic to the external IP. This directly contains the SQL injection attack by severing the attacker’s ability to exfiltrate cardholder data while preserving the forensic integrity of the compromised server. By isolating the database rather than shutting down the web server, the team stops the data breach without causing unacceptable business disruption—a critical balancing act for a CISM professional. On the Certified Information Security Manager exam, this scenario tests your understanding of containment as the immediate priority in incident response, before eradication or recovery. A common trap is choosing to patch the vulnerability first, which ignores ongoing data loss, or imaging the server without blocking outbound traffic. Remember the containment mantra: stop the bleed before you clean the wound.
CISM Incident Management Practice Question
This CISM practice question tests your understanding of incident management. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the database server from the network and block outbound traffic to the external IP.
Option B is correct because the immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Shut down the web application and database server immediately to stop the breach.
Why it's wrong here
This causes significant business disruption and may not be necessary if containment can be done selectively.
✓
Isolate the database server from the network and block outbound traffic to the external IP.
Why this is correct
This stops data exfiltration while preserving the web application's availability.
Clue confirmation
The clue words "first", "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Patch the SQL injection vulnerability in the web application and continue monitoring.
Why it's wrong here
Patching alone does not stop the ongoing data transfer and may leave the database exposed.
✗
Take a full forensic image of all servers before taking any containment actions.
Why it's wrong here
While evidence preservation is important, immediate containment is necessary to stop data loss.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'stopping the breach' with 'shutting everything down' (Option A), failing to recognize that containment actions like network isolation can halt data loss while preserving business continuity and evidence integrity.
Detailed technical explanation
How to think about this question
In a SQL injection attack, the attacker can use the database server as a pivot to exfiltrate data via outbound TCP connections (e.g., HTTP POST or DNS tunneling). Isolating the database server at the network layer (e.g., by applying an ACL on the switch port or using iptables to drop traffic to 6.6.6.6) stops data flow without losing volatile evidence like active connections or process memory. The forensic analyst can later acquire a live memory dump before powering down, preserving evidence of the injection payload and exfiltration commands.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Incident Management — This question tests Incident Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the database server from the network and block outbound traffic to the external IP. — Option B is correct because the immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.
What should I do if I get this CISM question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first", "minimum / minimize". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the incident response manager for a mid-sized e-commerce company. At 2:00 PM, the security operations center receives an alert from the intrusion detection system indicating a potential SQL injection attack against the customer database server. The server hosts a critical database containing customer PII and payment card data. The alert shows multiple suspicious queries from an internal IP address 192.168.10.50, which belongs to the development team's jump box. The development team uses this jump box to access production servers for maintenance. The jump box is managed by the IT operations team. The CEO is currently in a meeting with investors and cannot be disturbed. The CISO is on leave. The company has a written incident response plan that designates the IT director as the incident response coordinator in the absence of the CISO. The IT director has limited security knowledge. The database administrator (DBA) reports that the database is experiencing high CPU usage and that some customer records appear to have been modified. You need to take immediate action. What should you do FIRST?
hard
A.Shut down the database server to prevent further data loss
B.Contact the development team lead to ask about the activity
✓ C.Isolate the jump box from the network immediately
D.Escalate the incident to the IT director and request guidance
Why C: Isolating the jump box (192.168.10.50) is the correct first action because it immediately stops the active SQL injection attack at its source, preventing further data exfiltration or modification. The suspicious queries originate from this internal IP, and containment is the priority in incident response to halt the threat before investigation or recovery. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the attack vector before preserving evidence or notifying stakeholders.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.