Before choosing recovery strategies, a company wants to identify which business processes are most critical, how disruption to each would affect revenue and obligations over time, and how long each can be down. Which activity should it perform?
Select an answer to reveal the explanation.
Short Explanation
A BIA asks one blunt question about each process: if this stops, how much does it hurt, and how fast does the pain grow? Those answers become your downtime targets. The trap is the tabletop exercise, which tests a plan you haven't built yet.
Full Explanation
A business impact analysis identifies critical business functions, the resources and dependencies they rely on, and the operational, financial, legal, and reputational impact of their disruption over time. From that analysis come recovery priorities and objectives such as maximum tolerable downtime, recovery time objective, and recovery point objective, which in turn drive the selection of recovery strategies and the design of continuity and disaster recovery plans. Because the scenario asks for criticality, impact over time, and tolerable downtime before choosing strategies, it describes a BIA. A risk register review revisits the status of identified risks, owners, and treatments; it tracks threats and controls but does not establish process criticality or downtime tolerances. A vulnerability assessment finds technical weaknesses in systems; it reveals what could fail but not which business processes matter most or for how long they can be unavailable. A tabletop exercise walks participants through a scenario to test a plan and decision-making; it presumes a plan and recovery objectives already exist, so it comes after the BIA. Exam caveat: the BIA is business-led, so its results should be validated with process owners rather than estimated by IT alone. Operational check: confirm every critical process in the BIA has an agreed RTO and RPO signed off by its business owner.