CISM Incident Management Practice Question
During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determine the process failure that allowed the vulnerability to go unaddressed.
The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Determine the process failure that allowed the vulnerability to go unaddressed.
Why this is correct
A technical vulnerability is a symptom; CISM root cause analysis must progress to the management system. Determining which process failed to identify, assess, or remediate that vulnerability addresses the underlying governance weakness, preventing recurrence rather than merely patching one flaw.
- ✗
Immediately patch the vulnerability and move on.
Why it's wrong here
Patching treats the symptom; the 5 Whys continues upward to the management or process failure that allowed the vulnerability to persist. It tempts as remediation is necessary, but remediation is a separate corrective action, not the next analytical level the technique demands.
- ✗
Escalate the issue to the vendor for a software fix.
Why it's wrong here
Vendor escalation outsources the fix and halts internal analysis; the 5 Whys should continue to the management oversight or patch-management process that failed. It tempts because vendor remediation is often required, but it is a corrective action, not the next analytical level.
- ✗
Identify the specific employee responsible for the vulnerability.
Why it's wrong here
Root cause analysis examines systemic and process failures, not individual blame; naming an employee stops the inquiry prematurely. It tempts because accountability matters, yet CISM practice targets the control or governance gap that permitted the vulnerability, not a person.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.