Which of the following is the PRIMARY reason to use a phased incident recovery approach?

Question

Options

• ATo gain management buy-in
• BTo prioritize remediation steps
• CTo ensure critical systems are recovered first
• DTo give the response team time to analyze incidents

• A
  2% (1)
• B
  5% (2)
• C
  90% (37)
• D
  2% (1)

Explanation

A phased incident recovery approach is primarily designed to restore operations in a structured order - starting with the most critical systems (like core infrastructure, authentication, or production databases) before moving to less essential ones, ensuring the organization can resume essential functions as quickly as possible. Option A (management buy-in) is a communication or governance concern, not a structural reason for phasing recovery. Option B (prioritizing remediation steps) is close, but remediation focuses on fixing vulnerabilities, whereas recovery focuses on restoring services - the phasing is about what gets restored when, not patching priority. Option D (giving the team time to analyze) describes a benefit of a measured pace, not the primary purpose of a phased approach.

Memory tip: Think of it like a hospital emergency: doctors stabilize the heart before treating a broken arm. Phases = critical first, everything else follows.

No community discussion yet for this question.