Which of the following is the BEST indicator of a successful intrusion into an organization's systems?

The correct answer is C. Increase in the number of irregular application requests. Irregular application requests - unexpected API calls, unauthorized resource access, abnormal query patterns - are strong behavioral indicators that an attacker is actively interacting with systems post-compromise. Increased failed logins (B) typically indicate attempted intrusio

Submitted by jakub_pl· Apr 18, 2026Information Security Incident Management

Question

Options

ADecrease in available storage space
BIncrease in the number of failed login attempts
CIncrease in the number of irregular application requests
DDecrease in internal network traffic

How the community answered

(25 responses)

A
4% (1)
B
4% (1)
C
84% (21)
D
8% (2)

Explanation

Irregular application requests - unexpected API calls, unauthorized resource access, abnormal query patterns - are strong behavioral indicators that an attacker is actively interacting with systems post-compromise. Increased failed logins (B) typically indicate attempted intrusion (e.g., brute force), not a successful one. Decreased storage (A) could suggest data staging but is nonspecific. Decreased internal network traffic (D) is counterintuitive; successful intrusions generally increase traffic through lateral movement and data exfiltration activity.

Topics

#Intrusion detection#Incident indicators#Security monitoring#Compromise detection

Community Discussion

No community discussion yet for this question.

Full CISM Practice