SSCP Incident Response and Recovery Practice Question
An organization uses a hot disaster recovery (DR) site and has a Recovery Time Objective (RTO) of 4 hours. During a DR test, the team discovers that data replication from the primary site fails. Which TWO actions should the team take to meet the RTO while ensuring data integrity? (Choose two.)
⚠ Common exam trap
A common misconception is that failing over to a hot site immediately is sufficient, but the trap here is that without verifying and restoring a valid backup, the DR site may contain corrupted or incomplete data, breaking data integrity requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the integrity of the backup before restoration using hash checks.
Verifying the integrity of the backup using hash checks (e.g., SHA-256 or MD5) ensures that the data has not been corrupted during storage or transfer, which is critical before restoration to maintain data integrity. Option D is correct because restoring the latest valid backup from the primary site to the DR site provides a known-good data set, allowing the organization to meet the 4-hour RTO by having a consistent state to failover to, even if replication has failed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify the integrity of the backup before restoration using hash checks.
Why this is correct
Ensuring backup integrity prevents restoring corrupted or infected data.
- ✗
Extend the RTO to allow time for manual data re-entry.
Why it's wrong here
RTOs are defined requirements; extending them indicates a failure of the DR plan.
- ✗
Failover to the hot DR site immediately without data restoration.
Why it's wrong here
Without replicated data, the hot site may have stale or no data, causing data loss and operational failure.
- ✓
Restore the latest valid backup from the primary site to the DR site.
Why this is correct
Restoring from a known-good backup brings data current and supports the RTO if the backup is recent enough.
- ✗
Switch to a cold DR site that requires hardware setup.
Why it's wrong here
A cold site takes days to activate, exceeding the 4-hour RTO.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.