easyMultiple SelectObjective-mapped
CISM Practice Question: Which TWO are key indicators of a data breach?…
Which TWO are key indicators of a data breach? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse indicators of a data breach (e.g., unauthorized access or data exfiltration) with indicators of an attack in progress (e.g., failed logins or spam), failing to distinguish between a confirmed breach and a potential security event that may or may not lead to a breach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unusual outbound network traffic
Unusual outbound network traffic is a key indicator of a data breach because it often signals data exfiltration, where an attacker is transferring stolen data to an external command-and-control (C2) server or a cloud storage endpoint. This traffic may involve unexpected protocols (e.g., DNS tunneling, HTTPS to unknown IPs) or large volumes of data leaving the network at odd hours, which can be detected by network traffic analysis tools like NetFlow or intrusion detection systems (IDS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System performance degradation
Why it's wrong here
Performance degradation can have many causes and is not a key indicator of a breach.
- ✓
Unusual outbound network traffic
Why this is correct
Unusual outbound traffic, especially to unknown IPs, is a common sign of data exfiltration.
- ✗
Increased spam emails to the organization
Why it's wrong here
Spam is more associated with phishing campaigns, not a breach indicator.
- ✓
Unauthorized access to sensitive data
Why this is correct
Unauthorized access to sensitive data is a direct indicator of a breach.
- ✗
Multiple failed login attempts from a single user
Why it's wrong here
Failed logins may indicate brute force but not necessarily a data breach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.