CISM Incident Management Practice Question
Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a change management process to prevent unauthorized configuration changes
Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a change management process to prevent unauthorized configuration changes
Why this is correct
Addressing the process failure that allowed the misconfiguration prevents similar issues across the organization.
- ✗
Update the firewall rule base immediately
Why it's wrong here
Fixing the technical issue is necessary but does not address underlying process or management failures.
- ✗
Conduct a vulnerability scan on all firewalls
Why it's wrong here
Scanning is reactive and does not address the root cause of improper change control.
- ✗
Disconnect the firewall from the network
Why it's wrong here
Disconnecting is an extreme measure that may disrupt operations and does not solve the root cause.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.