hardMultiple ChoiceObjective-mapped
CISM Practice Question: The information security manager for a financial…
You are the information security manager for a financial services company that processes credit card transactions. The company uses a mix of on-premises servers and cloud services. During a routine vulnerability scan, you discover that one of the web servers has been compromised with a web shell that allows remote command execution. The server is part of a cluster that handles customer-facing web traffic. The incident response team is activated. The team's immediate actions include isolating the server from the network and taking a forensic image. However, the server is critical for business operations, and management is pressuring you to restore service quickly. The server's logs show that the web shell was uploaded three days ago, and during that time, the server processed approximately 10,000 transactions. The team has not yet fully analyzed the forensic image. You need to decide on the next steps. What should you do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a thorough analysis of the forensic image to determine the extent of data access and exfiltration.
Before any restoration, it is critical to conduct a thorough forensic analysis to determine the extent of the breach, including whether sensitive data (e.g., credit card numbers) was accessed or exfiltrated. This analysis informs legal, regulatory, and compliance obligations. Option A is premature without understanding the full impact of the compromise. Option B is risky as the root cause may not be fully addressed, and the backup may also be compromised. Option C may be necessary later but is not the first priority; internal investigation should precede external notification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the next scheduled patch cycle to apply updates and then restore the server.
Why it's wrong here
Delaying response could increase risk and regulatory exposure.
- ✗
Restore the server from the most recent clean backup and bring it back online immediately to minimize revenue loss.
Why it's wrong here
Restoring without full analysis may miss evidence of data exfiltration.
- ✗
Notify the payment card industry (PCI) compliance auditor and request guidance on next steps.
Why it's wrong here
Notification is important but should be based on confirmed facts.
- ✓
Conduct a thorough analysis of the forensic image to determine the extent of data access and exfiltration.
Why this is correct
Understanding the breach scope is critical for response and notification.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.