When making recommendations, what should you identify first?

• A. The most expensive fix
• B. The target's hardware vendor
• C. Root cause of the problem
• D. The most famous tool

Answer: (C)

Identifying the root cause first is essential because the remediation must address what actually allowed the issue to occur, not just its symptoms. When you pinpoint the underlying reason, you can design fixes that meaningfully reduce risk, prevent recurrence, and align with how the system operates. This also helps define the scope of the remediation, identify who or what is affected, and establish concrete validation steps to prove the problem is resolved.

If you skip root cause and jump to a fix, you risk applying a band-aid that doesn’t solve the real vulnerability, wastes resources on unnecessary changes, or misses related weaknesses elsewhere in the environment. For example, patching a service version without understanding whether a misconfiguration or insecure access control enabled the breach can lead to the same issue resurfacing in other parts of the system.

The focus on the root cause ensures you choose targeted, effective actions and can justify them based on how they mitigate risk, rather than chasing the most expensive fix or chasing a particular vendor or tool.