Exam CISM topic 1 question 523 discussion

B. Identify the source and nature of the attempts should be the information security manager's first course of action after an organization's intrusion prevention system (IPS) detected and blocked an unusually large number of external intrusion attempts within a 24-hour period. Identifying the source of the intrusion attempts, such as the IP addresses or domains involved, and the nature of the attempts, such as the types of attack vectors used, can help to determine the level of threat and the potential impact on the organization. This information can then be used to take appropriate defensive measures, such as blocking the IP addresses or domains involved, and hardening systems against the attack vectors used. The other options such as performing security assessments on Internet-facing systems, reviewing the server and firewall audit logs and reporting the issue to senior management are also important, but identifying the source and nature of the attempts should be the first step to take.

You do B by doing C (and vice versa). However, I think the question here is more about the purpose of the next steps, which is indeed identifying the source and nature of the events. It's an unfair question though, given the ambiguous answer options.

How do you identify the source without analysing the logs?

The question is what do you check to identify the source of attempts. Your first step is to review logs, then analyze and determine the nature.Reviewing server and firewall logs would precede any further analysis

Root cause analysis, i.e., identifying and analyzing the source will be the first recourse. Security assessments of internet-facing systems and reviewing server and firewall logs can support analysis of the depth and nature of problem, but only after identifying the source.

You are more than likely going to need to do C in order to achieve B so it seems a bit backwards HOWEVER... B could potentially be achieved WITHOUT digging through firewall logs. So if we are being specific about it (which for once ISACA actually is) identifying the source and nature is top priority.

B sounds good ,think like a manager.

B. Identify the source and nature of the attempts.

Answer is C, because even to do the action in option B, we need logs.

Trying to identify the nature of the attack does make more sense to me. The attack has been prevented so don't see the point in reviewing audit logs. Also, as a part of identifying the issue, one would check all types of logs.

B should be correct in my point of view as per question

evaluate the security of system facing threat.

I agree with EZPASS, you need to review the logs in order to gain an understanding of the source of the attack.

I think B is correct. You already have detected, next course of action should be investigate

I think the correct answer is C. The "first" action is to review and investigate the alerts/logs to understand the behavior of the intrusions. You identify by reviewing the logs to extract as much information as possible.

Agreed

Why review the logs when you already know what happened? Why not investigate? I'd go with B