hardMultiple SelectObjective-mapped
CISM Practice Question: Which THREE are valid sources for threat…
Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)
⚠ Common exam trap
ISACA CISM often tests the distinction between operational data (logs) and external threat intelligence, leading candidates to incorrectly select internal logs as a threat intelligence source instead of recognizing them as evidence for detection and analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Industry information sharing groups
Industry information sharing groups (Option B) are a valid source of threat intelligence because they provide curated, actionable data on emerging threats, indicators of compromise (IOCs), and attack patterns from peer organizations. This intelligence is directly applicable during incident response to identify known adversary tactics, techniques, and procedures (TTPs) and to correlate findings with ongoing incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Social media posts from employees
Why it's wrong here
Employee social media posts are not authoritative and may contain misinformation.
- ✓
Industry information sharing groups
Why this is correct
Information sharing groups (e.g., ISACs) provide curated threat intelligence from peer organizations.
- ✓
Vendor vulnerability databases
Why this is correct
Vendor databases (e.g., NVD, vendor advisories) provide official vulnerability information.
- ✓
Open-source intelligence (OSINT)
Why this is correct
OSINT provides publicly available threat data from sources like blogs, forums, and news.
- ✗
Internal network traffic logs
Why it's wrong here
Internal logs are operational data, not threat intelligence; they are used for detection, not as an external source.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.