CISM Incident Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To identify the technical vulnerability that was exploited

  Why it's wrong here

  Identifying the exploited vulnerability is one finding, yet RCA examines all contributing causes — process gaps, detection failures, human factors — not just the technical flaw. Vulnerability identification suits patch management and scanning activities; RCA aims to prevent recurrence of the whole incident, not merely the single exploited weakness.

• ✓

  To determine process and governance failures that allowed the incident to occur

  Why this is correct

  RCA examines the underlying process and governance failures that permitted the incident, not merely the technical trigger. This satisfies the stem's demand for the primary purpose: preventing recurrence by correcting systemic weaknesses in controls, oversight and decision-making, rather than attributing blame or documenting the event itself.

• ✗

  To satisfy regulatory reporting requirements

  Why it's wrong here

  Regulatory reporting may follow an incident, but RCA's purpose is understanding how and why the incident occurred so controls can be improved. Reporting obligations are satisfied by notification and documentation processes, not by the causal investigation itself, so this describes an outcome rather than the primary purpose.

• ✗

  To assign blame to responsible individuals

  Why it's wrong here

  RCA is a blameless investigative process; its purpose is establishing causal factors and preventing recurrence, not attributing fault to people. Blame assignment belongs to HR or disciplinary procedures, and pursuing it undermines the honest reporting RCA depends on, so it cannot be the primary purpose.

Go deeper

Related to this question