The answer is to block the malicious IP at the firewall while leaving the server connected. This containment strategy directly stops data exfiltration by severing the active command-and-control channel on port 443, yet it preserves the server’s volatile state—memory, processes, and network connections—for live forensics. A hard shutdown or full isolation would destroy this critical evidence, potentially violating the regulatory requirement to report a PII breach within 72 hours. On the CISM exam, this scenario tests your ability to balance incident response containment with evidence preservation, a core principle of the “Containment, Eradication, and Recovery” domain. The common trap is to choose immediate isolation, but that eliminates the chance to gather volatile data and confirm scope. Memory tip: “Block the link, don’t sink the ship”—sever the malicious connection without taking the server offline.
CISM Incident Management Practice Question
This CISM practice question tests your understanding of incident management. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are the incident response manager for a financial services company. The company has a hybrid infrastructure with on-premises servers and cloud services. At 2:00 AM, the SIEM generates a critical alert: a database server in the DMZ is communicating with a known malicious IP address on port 443. The server contains customer PII. The on-call security analyst reports that the server is running and the connection is active. The incident response plan states that any confirmed compromise of PII must be reported to the regulator within 72 hours. You have the following options: A) Immediately isolate the server by disconnecting it from the network, then begin forensic analysis. B) Leave the server connected to gather more intelligence about the attacker's actions, but block only the malicious IP at the firewall. C) Shut down the server to preserve evidence and prevent data exfiltration. D) Copy the server's disk over the network for forensic analysis before taking any action. Which option is the BEST course of action?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the malicious IP and monitor the server
Option D is the best course of action because it balances the need to stop the immediate data exfiltration threat with the preservation of forensic evidence and the regulatory requirement to report a PII breach within 72 hours. By blocking only the malicious IP at the firewall, you sever the active command-and-control (C2) channel on port 443 while keeping the server running, which allows you to collect volatile data (e.g., memory, active processes, network connections) and perform live forensics without destroying evidence. This approach also avoids the risk of losing critical evidence that would occur with a hard shutdown or isolation, and it provides time to confirm the scope of the compromise before the 72-hour clock starts for regulatory reporting.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Isolate the server immediately
Why it's wrong here
Isolation may alert the attacker and prevent gathering intelligence.
✗
Shut down the server
Why it's wrong here
Shutting down loses volatile memory evidence and may cause data loss.
✗
Copy the disk over the network
Why it's wrong here
Network copy may be slow and could be detected; also does not stop exfiltration.
✓
Block the malicious IP and monitor the server
Why this is correct
This stops the exfiltration while allowing observation of other activities.
Clue confirmation
The clue words "best", "immediately / without restart" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISACA often tests the misconception that shutting down or isolating a server immediately is always the safest action, but in reality, this destroys volatile evidence and can violate forensic chain-of-custody requirements, making Option D the correct balance between containment and evidence preservation.
Detailed technical explanation
How to think about this question
In incident response, the 'live response' approach (as in Option D) is preferred when dealing with active C2 channels because it allows you to capture volatile data using tools like FTK Imager or Volatility before any action that could alter system state. Blocking the IP at the firewall (e.g., using an ACL or iptables rule) stops the specific TCP session on port 443 without affecting other services, preserving the ability to monitor the server's behavior for lateral movement or additional indicators of compromise (IOCs). The 72-hour regulatory reporting window under GDPR or similar frameworks starts from the moment you have 'reasonable belief' of a PII breach, so collecting evidence quickly is essential to determine if PII was actually exfiltrated before reporting.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISM exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Incident Management — This question tests Incident Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Block the malicious IP and monitor the server — Option D is the best course of action because it balances the need to stop the immediate data exfiltration threat with the preservation of forensic evidence and the regulatory requirement to report a PII breach within 72 hours. By blocking only the malicious IP at the firewall, you sever the active command-and-control (C2) channel on port 443 while keeping the server running, which allows you to collect volatile data (e.g., memory, active processes, network connections) and perform live forensics without destroying evidence. This approach also avoids the risk of losing critical evidence that would occur with a hard shutdown or isolation, and it provides time to confirm the scope of the compromise before the 72-hour clock starts for regulatory reporting.
What should I do if I get this CISM question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best", "immediately / without restart". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.