Question 234 of 871
mediumMultiple ChoiceObjective-mapped
Incident Response: Containing a SQL Injection Data Breach
You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?
Quick Answer
The correct first action is to isolate the database server from the network and block outbound traffic to the external IP. This directly contains the SQL injection attack by severing the attacker’s ability to exfiltrate cardholder data while preserving the forensic integrity of the compromised server. By isolating the database rather than shutting down the web server, the team stops the data breach without causing unacceptable business disruption—a critical balancing act for a CISM professional. On the Certified Information Security Manager exam, this scenario tests your understanding of containment as the immediate priority in incident response, before eradication or recovery. A common trap is choosing to patch the vulnerability first, which ignores ongoing data loss, or imaging the server without blocking outbound traffic. Remember the containment mantra: stop the bleed before you clean the wound.
⚠ Common exam trap
Many exam-takers confuse 'stopping the breach' with 'shutting everything down' (Option A), failing to recognize that containment actions like network isolation can halt data loss while preserving business continuity and evidence integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the database server from the network and block outbound traffic to the external IP.
The immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shut down the web application and database server immediately to stop the breach.
Why it's wrong here
This causes significant business disruption and may not be necessary if containment can be done selectively.
- ✓
Isolate the database server from the network and block outbound traffic to the external IP.
Why this is correct
This stops data exfiltration while preserving the web application's availability.
- ✗
Patch the SQL injection vulnerability in the web application and continue monitoring.
Why it's wrong here
Patching alone does not stop the ongoing data transfer and may leave the database exposed.
- ✗
Take a full forensic image of all servers before taking any containment actions.
Why it's wrong here
While evidence preservation is important, immediate containment is necessary to stop data loss.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the incident response manager for a mid-sized e-commerce company. At 2:00 PM, the security operations center receives an alert from the intrusion detection system indicating a potential SQL injection attack against the customer database server. The server hosts a critical database containing customer PII and payment card data. The alert shows multiple suspicious queries from an internal IP address 192.168.10.50, which belongs to the development team's jump box. The development team uses this jump box to access production servers for maintenance. The jump box is managed by the IT operations team. The CEO is currently in a meeting with investors and cannot be disturbed. The CISO is on leave. The company has a written incident response plan that designates the IT director as the incident response coordinator in the absence of the CISO. The IT director has limited security knowledge. The database administrator (DBA) reports that the database is experiencing high CPU usage and that some customer records appear to have been modified. You need to take immediate action. What should you do FIRST?
hard- A.Shut down the database server to prevent further data loss
- B.Contact the development team lead to ask about the activity
- ✓ C.Isolate the jump box from the network immediately
- D.Escalate the incident to the IT director and request guidance
Why C: Isolating the jump box (192.168.10.50) is the correct first action because it immediately stops the active SQL injection attack at its source, preventing further data exfiltration or modification. The suspicious queries originate from this internal IP, and containment is the priority in incident response to halt the threat before investigation or recovery. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the attack vector before preserving evidence or notifying stakeholders.
Last reviewed: Jun 11, 2026
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.