Exam CISM topic 1 question 108 discussion

Containment is the first act upon any confirmed incidents.

D is correct answer - notify senior mgmt. Remember this is a CISManager exam so you would manage the situation both up (to senior mgmt) and down (secops engineers).

B. Isolate the impacted endpoints. Isolating the impacted endpoints should be the information security manager's FIRST step upon discovering that a ransomware attack has been triggered by an employee clicking on a link in a phishing email. This action is essential to prevent the ransomware from spreading further across the organization's network, thereby containing the attack and minimizing potential damage. Isolating affected systems helps in protecting unaffected resources and is a critical step in managing and mitigating the incident effectively. While senior management's involvement and guidance are essential, especially in handling communications, legal considerations, and overarching organizational responses, the urgency of containing the ransomware attack to minimize its impact dictates that notifying senior management should follow after initial containment efforts have been initiated. This approach aligns with incident response best practices that prioritize immediate actions to secure the organization’s IT environment.

D is the best choice, you have to come in terms to define the function of an information security manger, this is managerial position not operation position, if it was CASP+, GIAC, B will be the answer

Report to management first is the correct step even if it does look not a smartest way. In real life, just inform the management first, and another second later, give a call to the IT supervisor to quarantine the PC/whole VLAN/whole network segment. Cut the connections between operations and backup storage links (normally, should always have an airgap)

Manager Himself doesnt do operational work(eg isolate endpoints etc). Also, if the ransomware happened, is too late to deal with endpoints. Now is time to deal with the request hence D, notify the big guys

Containment first. While B and D are essential, do you do B first or D first

Knowing the meaning of the Ransome attack might help. The Ransome attack has already gone beyond containment it already involves payment, and a decision needs to be made

While it's tempting to pick B (isolate), you have to remember that this is management level exam (similar to CISSP). This means you don't touch anything, only consult, advise, steer... While it is absolutely correct that the next thing you do upon confirming the incident is to contain it (in this case, isolate the affected endpoints), as a infosec manager you don't do that, you go ahead and inform management. So D, in my opinion.

ISACA emphasizes the importance of promptly notifying senior management about security incidents to ensure appropriate decision-making, resource allocation, and coordination of response efforts. Senior management needs to be informed early on to understand the potential impact of the incident, assess the organization's risk exposure, and authorize necessary actions.

B. Isolate the impacted endpoints.

In such attacks, quick response makes a difference, hence if device is isolated, mgt can be notified. B then D

The ISM is not going to be isolating anything aka not implementing actions. His role instead would be assess the situation and inform management.

B, then D