CISM Incident Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DDoS

  Why it's wrong here

  DDoS floods services to exhaust availability; it involves no authenticated insider and no access to systems or data. It is tempting as a headline incident category, yet it would be the answer only when the scenario describes traffic saturation rather than an internal individual misusing legitimate access.

• ✗

  Data breach

  Why it's wrong here

  A data breach names the outcome — exposure of confidential data — not the category describing an insider's unauthorised access. It is tempting because insider misuse often produces a breach, but the question asks for the incident category, which is insider threat, regardless of whether data actually left.

• ✗

  Ransomware

  Why it's wrong here

  Ransomware is malware encrypting data for extortion, typically delivered externally; it does not describe an individual within the organisation accessing systems without authorisation. It is tempting because ransomware is a common incident category, but it would be correct only where the scenario names encryption and a ransom demand.

• ✓

  Insider threat

  Why this is correct

  Insider threat covers misuse by employees, contractors or partners holding legitimate access, so it directly satisfies the stem's requirement that the actor be an individual within the organization. Unlike external attacks, the access is authorised initially, making detection harder and distinguishing it from other incident categories.