CISSP Security and Risk Management Practice Question
Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)
⚠ Common exam trap
CISSP often tests the distinction between hot, warm, and cold sites, and candidates may confuse the characteristics of a hot site with those of a warm or cold site, especially regarding activation time and data replication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pre-installed servers and workstations
A hot site is a fully equipped alternate facility that is ready to operate almost immediately, so pre-installed servers and workstations (A) are essential components because they eliminate procurement and build time during failover. Real-time data replication from the primary site (C) is also required so the hot site holds current, usable data with minimal RPO, typically achieved through synchronous or asynchronous replication. Network connectivity with sufficient bandwidth to support operations (D) is likewise critical, since the hot site must carry production traffic and connect users, systems, and replicated data without performance degradation. Option B describes a cold site, which provides only space, power, and cooling with no pre-installed equipment, and option E describes a cold or warm site characteristic, since a hot site is designed for rapid activation, often within minutes or hours, not weeks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pre-installed servers and workstations
Why this is correct
A hot site's defining characteristic is its immediate operational readiness. This means all necessary computing hardware, including servers, storage, and end-user workstations, must be pre-installed, configured, and often pre-loaded with essential operating systems and applications. This readiness minimizes recovery time objectives (RTO) by eliminating the need for hardware procurement and setup during a crisis, allowing for rapid business resumption.
- ✗
Empty space with power and cooling only
Why it's wrong here
This option describes a cold site, which provides only the basic infrastructure like power, cooling, and physical space, but lacks pre-installed hardware, software, or network connectivity. A hot site, by contrast, is fully equipped and ready for immediate operation, often mirroring the primary site's environment. Therefore, an empty space with only power and cooling is not a key component of a hot site.
- ✓
Real-time data replication from primary site
Why this is correct
To ensure business continuity with minimal data loss, a hot site relies on continuous, often real-time, data replication from the primary production site. This ensures that when a failover occurs, the recovery site possesses the most current transactional data, allowing operations to resume with a very low recovery point objective (RPO). Without up-to-date data, even a fully equipped site cannot restore critical business functions effectively.
- ✓
Network connectivity with bandwidth to support operations
Why this is correct
A fully functional hot site requires robust and pre-established network connectivity, including sufficient bandwidth, to support all critical business operations and user access immediately upon activation. This encompasses internal network infrastructure, external internet access, and often dedicated links to the primary site for replication and failover traffic. Reliable network infrastructure is essential for connecting users, applications, and data, ensuring seamless transition and continued service delivery.
- ✗
Long lead time to activate (e.g., weeks)
Why it's wrong here
A hot site is specifically designed for rapid activation, typically within hours, to meet stringent recovery time objectives (RTOs) for mission-critical systems. A long lead time, such as weeks, is characteristic of a cold site or even a warm site, where significant setup, configuration, and data restoration are still required before operations can commence. This contradicts the fundamental purpose and benefit of a hot site, which is immediate operational readiness.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.