CISM Incident Management Practice Question
Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security team did not have a change management process for security control configurations.
The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employees should have been trained to recognize phishing emails.
Why it's wrong here
Phishing awareness training is an operational control, not the governance failure identified: the absent firewall rule change review process. It is tempting because user training is a common lessons-learned recommendation, and would be correct had the root cause been repeated successful user clicks rather than a filter misconfiguration left unreviewed.
- ✗
The email filter vendor did not provide adequate support.
Why it's wrong here
Vendor support quality is a procurement concern, not the governance failure the stem describes: no formal process for reviewing firewall rule changes. It is tempting because third-party dependency is a legitimate lessons-learned category, and would be correct had the misconfiguration stemmed from inadequate vendor guidance rather than absent internal change review.
- ✓
The security team did not have a change management process for security control configurations.
Why this is correct
The root cause is a governance gap: no change management process governed security control configuration changes, so the email filter misconfiguration went unreviewed. Documenting this management failure addresses the underlying control weakness rather than the phishing symptom.
- ✗
The incident response plan was not followed during the incident.
Why it's wrong here
The stem attributes the incident to a missing firewall rule review process, not to response execution; nothing indicates the incident response plan was invoked and breached. It is tempting because IR plan adherence is a standard lessons-learned theme, and would be correct if the analysis had found delayed containment or skipped response steps.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.