Incident Management →mediumMultiple ChoiceObjective-mapped

CISM Incident Management Practice Question

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Escalate to the BC/DR team for possible activation of continuity plans

If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Ignore the MTD and focus solely on incident eradication
Why it's wrong here
This could lead to unacceptable business downtime.
✗
Continue incident response until full recovery
Why it's wrong here
If MTD is breached, waiting may cause unacceptable business impact.
✗
Declare a disaster immediately without further analysis
Why it's wrong here
A formal decision should involve the appropriate authority based on MTD.
✓
Escalate to the BC/DR team for possible activation of continuity plans
Why this is correct
This triggers BC/DR processes to protect business operations.

Visual reference

Go deeper

CISM Incident Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question