exam questions

Exam CISM All Questions

View all questions & answers for the CISM exam

Exam CISM topic 1 question 833 discussion

Actual exam question from Isaca's CISM
Question #: 833
Topic #: 1
[All CISM Questions]

Which of the following should be considered FIRST when recovering a compromised system that needs a complete rebuild?

  • A. Network system logs
  • B. Intrusion detection system (IDS) logs
  • C. Patch management files
  • D. Configuration management files
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Josef4CISM
1 month, 2 weeks ago
Selected Answer: D
answers A and B may give you hints about the attacker - but they do not necessarily help you in rebuilding the system. Answer D is right.
upvoted 1 times
...
wickhaarry
5 months, 1 week ago
C. Patch management files
upvoted 1 times
...
oluchecpoint
5 months, 3 weeks ago
Selected Answer: D
Configuration Management Files: These files store the system's configuration settings and can help you understand how the system was initially set up. Restoring the correct configuration is crucial to ensure the rebuilt system functions as intended and is secure. After compromising an operating system, an attacker may make changes to the system configuration to maintain access, create backdoors, or otherwise manipulate the system. Reverting to a known good configuration is essential to eliminate these malicious changes.
upvoted 4 times
...
richck102
7 months, 3 weeks ago
Selected Answer: D
D. Configuration management files
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago