ISC2 CC Business Continuity, DR & Incident Response Practice Question
A financial services company's business continuity plan includes a recovery time objective (RTO) of 4 hours for its trading platform. During a recent test, the platform was restored in 6 hours. Which of the following should be the PRIMARY focus of the after-action review?
⚠ Common exam trap
The trap here is thinking that the RTO should be adjusted to match actual recovery time, rather than improving recovery capabilities to meet the business requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identifying the causes of the delay and implementing improvements
When a recovery test exceeds the RTO, the after-action review must identify the root causes of the delay and implement corrective measures. This ensures the trading platform can meet its 4-hour RTO in a real disruption. Adjusting the RTO, replacing the team, or merely increasing test frequency does not address the specific performance gap revealed by the test.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increasing the frequency of full-scale disaster recovery tests
Why it's wrong here
More frequent testing may be beneficial, but it is not the primary focus of the after-action review. The immediate need is to understand why the RTO was missed and to implement improvements. Simply testing more often without addressing the root causes would likely reproduce the same delay. The review should first diagnose the problem before deciding on the cadence of future tests.
- ✓
Identifying the causes of the delay and implementing improvements
Why this is correct
The after-action review should analyze why recovery took longer than the RTO and recommend corrective actions. This might involve additional training, better documentation, more frequent backups, or infrastructure upgrades. The goal is to close the gap between actual and target recovery times, ensuring the trading platform can be restored within 4 hours in a real event. This directly addresses the shortfall.
- ✗
Updating the RTO to 6 hours to match actual performance
Why it's wrong here
Changing the RTO to match poor performance defeats the purpose of having a target based on business needs. The RTO is derived from the maximum tolerable downtime for the trading platform; if the business requires 4 hours, relaxing it to 6 hours could cause unacceptable financial and reputational damage. The review should instead identify why the target was missed and how to improve recovery capabilities.
- ✗
Replacing the entire disaster recovery team
Why it's wrong here
Replacing the team is a drastic and likely unjustified response. The delay could stem from process gaps, technology limitations, or inadequate resources rather than personnel incompetence. A root cause analysis should precede any personnel decisions. Focusing on team replacement ignores the need to understand and fix the underlying issues that caused the 6-hour recovery time.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Business continuity plan
A Business continuity plan (BCP) is a documented strategy that outlines how an organization will continue critical operations during and after a disruptive event.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.