SSCP Incident Response and Recovery Practice Question
A security analyst is reviewing the organization's disaster recovery plan and notices that the Recovery Time Objective (RTO) for a critical application is 2 hours, but the current recovery process takes 8 hours. Which of the following should the analyst recommend FIRST?
⚠ Common exam trap
The trap here is thinking that changing the RTO is the solution, but the RTO is a business requirement that should be met.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement additional automation to reduce recovery time.
When the actual recovery time exceeds the RTO, the priority is to improve the recovery process to meet the business requirement. Automation can reduce manual effort and errors, speeding up recovery. Adjusting the RTO or accepting risk should only be considered after attempting to meet the objective. Purchasing new infrastructure is a last resort and may not address process inefficiencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk and document the deviation.
Why it's wrong here
Accepting the risk might be an option if the cost of improvement outweighs the benefit, but it should not be the first recommendation. The analyst should explore ways to meet the RTO before considering risk acceptance. Documenting the deviation is part of risk management, but it doesn't solve the underlying issue of not meeting the recovery objective.
- ✗
Increase the RTO to 8 hours to match the current capability.
Why it's wrong here
Increasing the RTO would mean accepting a longer downtime, which may not be acceptable for a critical application. The RTO is a business requirement, not a technical limitation. Changing it without business justification could lead to significant operational impact. The analyst should first try to meet the existing RTO rather than adjust it.
- ✗
Purchase a new disaster recovery site.
Why it's wrong here
Purchasing a new DR site is a costly and time-consuming solution that may not be necessary. The problem might be solved with process improvements or automation. Before investing in infrastructure, the analyst should investigate why the recovery takes 8 hours and address inefficiencies. A new site might not even reduce the time if the process itself is slow.
- ✓
Implement additional automation to reduce recovery time.
Why this is correct
The RTO is not being met, so the first step is to improve the recovery process to meet the objective. Automation can significantly reduce manual steps and speed up recovery. Other options like increasing the RTO or accepting the risk might be considered later, but the initial recommendation should be to close the gap by enhancing the process. This aligns with continuous improvement in disaster recovery planning.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.