hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security analyst at a medium-sized company with…
You are a security analyst at a medium-sized company with 500 employees. The company uses a centralized log management system that collects logs from all servers and network devices. For the past week, you have noticed a pattern: every night at 2:00 AM, a series of failed login attempts occurs on the domain controller from an internal IP address (10.10.50.100). The attempts use the username "Administrator" and are always from the same workstation in the accounting department. The accounting department operates 9 AM to 6 PM, so no one is in the office at 2 AM. You have checked the workstation's physical security; it is in a locked office with access only by authorized accounting staff. The workstation is running Windows 10 with up-to-date antivirus and has no signs of compromise. You also checked the network switch logs and see that the workstation is connected to a specific port. You suspect the workstation might be compromised or being used remotely. What is the most appropriate next step?
⚠ Common exam trap
ISC2 often tests the candidate's ability to prioritize the incident response process; the trap here is that many candidates jump to containment (reimaging, blocking IP) or prevention (password complexity) without first performing forensic analysis to understand the scope and method of the compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a forensic analysis of the workstation to identify any malware or remote access tools.
The pattern of failed logins at 2 AM from a locked workstation with no signs of compromise strongly suggests a remote access tool (RAT) or hidden malware that is not detected by standard antivirus. Forensic analysis of the workstation is the most appropriate next step to identify the specific malware or remote access tool, its persistence mechanism, and the attacker's entry point, which is essential before taking any remediation actions. This aligns with the incident response process of identification and analysis before containment or eradication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reimage the workstation with a clean OS image and reset all passwords.
Why it's wrong here
Reimaging destroys evidence needed to understand the attack and may not stop the attacker if they have other footholds.
- ✓
Perform a forensic analysis of the workstation to identify any malware or remote access tools.
Why this is correct
Forensic analysis can uncover the source of the logins and determine if the workstation is truly compromised.
- ✗
Increase the password complexity requirements for the domain.
Why it's wrong here
Password complexity does not address the fact that the attempts are from a specific internal workstation at odd hours, indicating a possible compromise.
- ✗
Immediately block the IP address at the firewall and disable the administrator account.
Why it's wrong here
While containment is important, doing so before investigation may alert the attacker and lose evidence of the compromise.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Log management
Log management is the process of collecting, storing, analyzing, and disposing of log data generated by computer systems, networks, and applications to ensure security, compliance, and operational health.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.