Comparison Table
| Option | Primary difference | Best use |
|---|---|---|
| Hot | Running or near-running | Fastest recovery, highest cost |
| Warm | Partially prepared | Balanced cost and recovery speed |
| Cold | Space and basics only | Lowest cost, slowest recovery |
Exam clue: Choose based on RTO/MTD and cost tolerance, not on the most impressive architecture.
How To Use It
Read the scenario for the required outcome. If the requirement is prevention, do not stop at detection. If the requirement is accountability, do not stop at authentication. If the requirement is recovery, distinguish data loss from service downtime.