easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A medium-sized financial services company has a…
A medium-sized financial services company has a flat network topology with no segmentation between the corporate LAN and the server farm. The security team recently deployed a host-based intrusion detection system (HIDS) on all critical servers. Over the past week, the HIDS has generated multiple high-severity alerts indicating outbound connections from a database server to an external IP address in a foreign country, occurring every hour and lasting only a few seconds. The database server contains sensitive customer data. The company's incident response plan (IRP) has not been updated in two years, and the CISO wants to ensure a response that minimizes business disruption while protecting data. The IT team is small, and the security analyst on duty suspects a data exfiltration attempt but is unsure. What should the analyst do FIRST?
⚠ Common exam trap
Test-takers frequently choose Option C (review firewall logs) because they think gathering evidence first is the correct incident response step, but the CISSP emphasizes containment as the immediate priority when there is an active, ongoing threat of data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the database server from the network at the switch port and preserve the system state for forensic analysis
The immediate priority is to contain the suspected data exfiltration by isolating the database server from the network, which stops the outbound connections and preserves volatile evidence for forensic analysis. Disconnecting at the switch port (e.g., via `shutdown` interface command) is a rapid, reversible action that minimizes business disruption compared to pulling the power cable, and it aligns with the incident response phase of containment before eradication or recovery. The HIDS alerts indicate a persistent, short-lived outbound connection pattern, which strongly suggests a beaconing or data-stealing malware that must be contained first to prevent further data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disconnect the database server from the network at the switch port and preserve the system state for forensic analysis
Why this is correct
Disconnecting the database server at the switch port immediately halts any ongoing data exfiltration or malicious activity, achieving critical containment. Preserving the system state, through memory capture or disk imaging, ensures that volatile evidence and forensic artifacts are maintained for subsequent detailed analysis without alteration by continued network access or system changes. This action prioritizes stopping the active breach and securing evidence for a thorough investigation.
- ✗
Run a full antivirus scan on the database server and update the HIDS signatures
Why it's wrong here
Running a full antivirus scan is a reactive measure that consumes significant time, during which an active attacker could continue data exfiltration or detect the scanning activity and adapt their tactics. Furthermore, updating HIDS signatures might not detect novel or zero-day exploits already present, and the scan itself does not immediately contain the active threat, leaving the system vulnerable to further compromise. Containment must precede lengthy investigative or remediation actions.
- ✗
Review the firewall logs to identify all external IPs the server has contacted
Why it's wrong here
Reviewing firewall logs is an investigative step crucial for understanding the scope and origin of the attack, but it does not actively stop the ongoing compromise or data exfiltration. Prioritizing log review over immediate containment allows the attacker more time to operate within the network or remove evidence, exacerbating the incident. Containment is the primary objective in the initial phase of incident response, before detailed analysis.
- ✗
Immediately notify the company's legal department and public relations team
Why it's wrong here
While stakeholder notification is an essential component of incident response, immediately informing legal and public relations teams before containment and initial assessment can lead to premature panic and the dissemination of inaccurate or incomplete information. The incident response lifecycle dictates that containment and eradication efforts should precede broad communication, ensuring that accurate details and a clear action plan can be presented. This approach prevents unnecessary alarm and maintains organizational credibility.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.