CISM Incident Management Practice Question
Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security team did not have a change management process for security control configurations.
The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employees should have been trained to recognize phishing emails.
Why it's wrong here
While training is important, the root cause here is a technical control failure, not user awareness.
- ✗
The email filter vendor did not provide adequate support.
Why it's wrong here
This is an external factor, not a management/governance failure within the organization.
- ✓
The security team did not have a change management process for security control configurations.
Why this is correct
A lack of change management for security controls is a governance failure that allowed the misconfiguration to persist.
- ✗
The incident response plan was not followed during the incident.
Why it's wrong here
This is not the root cause; the incident occurred due to a pre-existing control weakness.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.