EC-Council CCT · Lab Simulation · Active
🏛 Lab Environment — BC/DR Scenario

Kasen, a cybersecurity specialist at an organization, was working with the business continuity and disaster recovery team. The team initiated various business continuity and discovery activities in the organization. In this process, Kasen established a program to restore both the disaster site and the damaged materials to the pre-disaster levels during an incident.

Which of the following business continuity and disaster recovery activities did Kasen perform in the above scenario?

⚙️ BC/DR Phase Simulator
Simulation ready

Phase 1 · Prevention
Implementing controls, redundancy, and safeguards to reduce the likelihood or impact of a disaster before it occurs.
PROACTIVE
Phase 2 · Response
Immediate actions taken when a disaster or incident strikes — activating emergency protocols and stabilizing operations.
REACTIVE · IMMEDIATE
Phase 3 · Recovery ← ACTIVE
Restoring the disaster site and damaged materials to pre-disaster levels. Kasen's program focuses on this phase — rebuilding systems, infrastructure, and data back to operational baseline.
RESTORE · PRE-DISASTER LEVEL
Phase 4 · Resumption
Resuming normal business operations and activities after recovery work is complete. Focuses on continuity of business functions.
BUSINESS CONTINUITY
❓ Question · Select the Correct Answer

// Select the correct answer:

A. Prevention
B. Resumption
C. Response
D. Recovery
💡 Hint
Focus on the key phrase: "restore both the disaster site and the damaged materials to the pre-disaster levels." Which BC/DR activity specifically deals with bringing systems and materials back to the state they were in before the disaster occurred?
Mini Lesson
📚 Mini Lesson — BC/DR: Recovery Activity
01
Definition
Recovery is a business continuity and disaster recovery (BC/DR) activity focused on restoring systems, data, infrastructure, and physical materials to their pre-disaster state. It bridges the gap between the immediate response to a disaster and the eventual resumption of normal business operations.
02
How It Works
During the Recovery phase, teams execute predefined recovery plans to rebuild damaged systems, restore backups, repair physical sites, and validate that all resources meet the organization's pre-incident baseline. This includes data restoration, hardware replacement, and site rehabilitation.
03
Why It Matters
Without a structured Recovery program, organizations risk prolonged downtime, data loss, and incomplete restoration. A well-defined Recovery activity ensures that both the disaster site and all damaged materials are systematically returned to operational levels — a regulatory and operational necessity for most industries.
04
Real-World Example
After a ransomware attack encrypts a hospital's patient records system, the Recovery team restores clean data backups to production servers, rebuilds affected workstations from hardened images, and verifies that all patient records match the last known good state — bringing the environment back to pre-attack levels before resuming clinical operations.
05
Key Takeaway
Remember the distinction: Prevention stops disasters from happening. Response addresses the immediate crisis. Recovery restores everything to pre-disaster levels. Resumption gets the business running normally again. When a scenario mentions "restoring the site and damaged materials to pre-disaster levels," the answer is always Recovery.