Which Plan Manages the Restore Process After System Failure?
Which of the following is required for an organization to properly manage its restore process in the event of system failure?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the difference between a recovery plan and a recovery metric — the trap is choosing RPO, which only states how much data loss is tolerable, or IRP, which handles incident handling rather than full restoration.
Recovering systems, applications, and data after a failure requires a documented Disaster Recovery Plan (DRP) that defines the restoration strategy and priorities. This page explains why the SY0-701 scenario answer is the DRP rather than an IRP, RPO, or SDLC process.
Many candidates pick RPO because the words 'restore' and 'recovery' appear in its definition, but RPO is a target metric for acceptable data loss, not a plan, team, or procedure that actually manages restoring systems after a failure.
Community Discussion (11 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Disaster Recovery Plan (DRP) is the documented set of procedures, roles, priorities, and technical steps an organization uses to bring critical systems, applications, and data back online after a disruption, which is exactly what the question asks for. It covers restoration sequencing, alternate processing sites, backup restoration, and validation before returning to normal operations. NIST SP 800-34 treats this as the information system contingency and disaster recovery planning activity, distinct from routine backup scripts. Because the question says 'properly manage its restore process,' the governing artifact must be a plan, and the DRP is that plan.Why the Other Options Are Wrong
An IRP (Incident Response Plan) describes how to detect, contain, eradicate, and recover from a security incident, so its scope is incident handling rather than the broader business and system restoration process — one commenter summarized it well: "An IRP defines how to detect, contain, analyze, and resolve security incidents, while a DRP outlines how to restore critical systems." RPO (Recovery Point Objective) is a metric defining the maximum acceptable data loss measured in time, used to size backup and replication frequency; it guides the DRP but does not itself manage restoration. SDLC (Software Development Life Cycle) governs how software is designed, built, tested, and deployed, and has nothing to do with post-failure system restoration.Community Comment Notes
Consensus in the learner discussion lands firmly on the DRP, with Mehsotopes noting that "RPO would cover amount of data that is expected to be recovered given a failure while DRP encompasses the whole recovery process". dbrowndiver likewise describes the DRP as giving "detailed instructions on how to restore systems, applications, and data." One learner, _thelastturtle, initially answered A but reasoned that an IRP is really about responding to incidents, which matches the standard IRP-versus-DRP distinction. MAKOhunter33333333 framed the same idea succinctly: a DRP describes how "to restore business to be operational again." No commenter offered a credible argument for RPO or SDLC, reinforcing the plan-based reading of the question.Official Reference
Exam Strategy
When an exam question asks how an organization 'manages' or 'plans' a capability, look for the plan or framework, not a metric or a development model. Match each acronym to its purpose: IRP = incidents, DRP = disaster restoration, RPO/RTO = recovery targets, SDLC = software development.
Frequently Asked Questions
Why is RPO not the answer for managing the restore process after a failure?
RPO is only a metric for the maximum tolerable data loss, used to set backup and replication frequency. It informs the DRP but does not contain the procedures that restore systems and data.
When would an IRP be the right answer instead of a DRP?
An IRP is correct when the scenario is about detecting, containing, and eradicating a security incident. The DRP takes over when critical systems and data must be restored after disruption.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →