Exam CISM topic 1 question 318 discussion

D. Implement mitigating controls. When an online trading company discovers that a network attack has penetrated the firewall, the information security manager's first response should be to implement mitigating controls to contain and limit the scope of the attack as much as possible. This might include isolating the affected systems, shutting down or disconnecting compromised systems from the network, and implementing new firewall rules to block the attackers' IP addresses. This will help prevent the attackers from causing further damage, steal more data or spread the malware. After that, the information security manager can then evaluate the impact to the business, examine firewall logs to identify the attacker, and notify the regulatory agency of the incident.

The first part of the IR process is identifying and assessing the current state. An't do this without doing A. So (A) is the correct answer. Rationale: B. Knowing the attacker is great for attribution, but does little to address the issue C. This should only be done once the threat/impact is fully understood D. This should only be done once the threat/impact is fully understood

A is the choice, the question says PENETRATED and D reflects to options before getting PENETRATED.

Option A

Must pay attention to the role in question if nothing else. Managers do not implement controls, engineers and admins do.

It’s A because before any action you have to understand which is the business impact

As ever, first analyse/impact/confirm... whatever the phrase may be, take action to confirm exactly what the issue is before escalating any further

Evaluate first. Maybe you dont need more controls

Remember before you do anything like transfer, mitigate or etc... you need to evaluate the risk First to see how impactful it is to the business.

D. Implement mitigating controls.

Following ISACA's own model below - A is the logical answer as it follows the analysis of the incident https://www.isaca.org/resources/isaca-journal/issues/2020/volume-4/incident-response-models Preparation Detection and analysis Containment, eradication and recovery Postincident activity

I will go with A as a part of the Incident Response Plan, Tiage Phase after Indentfication was completed. D is more related to Rik Managment actions.

D was my choice; in the real world you need to shut it down ASAP. Best way would be to invoke mitigating controls