ISACA · CISM
Tools, investigation, and containment
CISM · Lesson 19 of 20 · 2:18:59
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: incident management tools like SIEM, SOAR, and UEBA, playbooks, investigation and the chain of custody for evidence, and containment. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- An employee’s account, which normally opens a few files a day, suddenly downloads ten thousand customer files at 3 a.m. Which tool is designed to flag this?
- An analyst copies a disk image from a compromised server, but no one writes down who handled it afterward. What is the main risk?
- A Stonebridge server is confirmed as compromised, and the attacker is using it to reach other systems. What should the team do first?