Investigators confirm a county breach began through an unpatched VPN appliance. Which activity ensures fixes address that underlying cause rather than only wiping infected PCs?
Select an answer to reveal the explanation.
Short Explanation
Root cause analysis asks how the burglar got the key, not just which rooms look messy. Finding the unpatched VPN as the entry means the county patches and hardens that path, not only scrubbing laptops. Wipe-and-restore without RCA invites the same break-in next week.
Full Explanation
Root cause analysis (RCA) determines the initiating weakness—here an unpatched VPN—so remediation closes the actual entry path. Symptom-only cleanup of endpoints, premature restores that leave the vulnerable VPN unchanged, or unrelated password resets fail to prevent recurrence. Effective IR pairs eradication and recovery with RCA-driven control improvements.