Which of the following is the PRIMARY objective of the incident management recovery phase?

The correct answer is D. To recover business operation support. The recovery phase of incident management is focused on restoring the organization's ability to conduct its business functions - not just restoring IT systems in isolation. Business operations are the end goal; IT systems are the means to that end. Bringing IT services back onlin

Submitted by jakub_pl· Apr 18, 2026Incident Management

Question

Options

ATo bring IT services back online
BTo perform a lessons-learned review
CTo document actions taken to restore IT systems
DTo recover business operation support

How the community answered

(42 responses)

A
2% (1)
B
2% (1)
D
95% (40)

Explanation

The recovery phase of incident management is focused on restoring the organization's ability to conduct its business functions - not just restoring IT systems in isolation. Business operations are the end goal; IT systems are the means to that end. Bringing IT services back online (A) is a technical task within recovery, but it is secondary to the broader objective of resuming business operations. Lessons-learned review (B) occurs in the post-incident or review phase, not the recovery phase. Documenting actions taken (C) is an ongoing activity throughout incident management and is not the primary objective of the recovery phase specifically. Answer D correctly frames the recovery phase in terms of business impact and purpose.

Topics

#Incident Management#Recovery Phase#Business Continuity#Service Restoration

Community Discussion

No community discussion yet for this question.

Full CISM Practice