Symptom or Root Cause? — TechKnowSurge

About this interactive

Sometimes the cause looks obvious: files are encrypted and a ransom note appears, so it is ransomware. But how did the ransomware get on the machine? Someone clicked a link in an email. Root cause analysis keeps asking why. Often it is not obvious. In the lesson's example users report a slow application. The team sees the database server's CPU at 100% and restarts it, and the complaints stop. The incident is over, but nothing has been learned. Tracing it back: the application waits on the database, the database CPU is pinned by one process, that process is running a stored procedure, and the procedure is being called wrongly by code on the application server. The code is the root cause. The restart treated a symptom; fixing the code stops it happening again. So read each card's chain to its last link. A fix that only makes the trouble go away for now, such as a restart, a manual clean-up or a bigger server, treats a symptom. A fix aimed at that last link reaches the root cause.

What you'll learn

Trace a problem back through its chain of causes and decide whether a proposed fix reaches the root cause or only treats a symptom
Explain why restoring service, as a restart can, is not the same as finding and fixing what caused the incident

Aligned to

NIST CSF

RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident.

CompTIA CySA+

3.3 Explain the preparation and post-incident activity phases of the incident management life cycle.

3.2 Given a scenario, perform incident response activities.

CompTIA Security+

4.8 Explain appropriate incident response activities.

NIST NICE

S0175 Skill in performing root cause analysis

K0957 Knowledge of root cause analysis tools and techniques

Key terms

Root Cause Analysis: A systematic investigation process that identifies the underlying cause of a security incident or system failure, going beyond symptoms to prevent recurrence. RCA findings drive corrective actions and improvements to security controls.
Corrective Action Plan: A documented set of action items developed to address the root cause of an incident and prevent it from happening again.
Incident Response: A structured process for identifying, containing, eradicating, and recovering from security incidents.

Topics

Incident Response Root Cause Analysis Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →