A widespread attack has disrupted dozens of systems, and the recovery team cannot restore them all at once. How should the security manager guide the order of restoration?
Select an answer to reveal the explanation.
Short Explanation
When you can't fix everything at once, you fix what the business can least live without. The BIA already did that ranking for you. The trap answers sort by convenience or noise, not by business impact.
Full Explanation
The business impact analysis identifies the organization's critical processes, the systems and dependencies that support them, the impact of their disruption over time and the recovery time and recovery point objectives agreed with business owners. During recovery from a widespread incident, those results provide a pre-agreed basis for sequencing: the most critical processes, and the infrastructure they depend on, are restored first. That ensures limited recovery resources reduce business impact as quickly as possible and avoids ad hoc disputes during a crisis. Restoring systems in the order they were compromised reflects the attack's timeline, not business value, and may leave critical processes down while less important systems are recovered. Prioritizing whatever can be restored fastest demonstrates activity but not value, and can consume resources while critical services stay unavailable. Prioritizing by complaint volume rewards noise rather than business impact and undermines the governance the BIA provides. Exam caveat: technical dependencies, such as identity services and networks, may need to be restored before the business systems they support, which the BIA and recovery plans should document. Operational check: confirm the recovery sequence is mapped to BIA priorities and dependencies, and track recovery against each system's recovery time objective.