A security manager is comparing recovery site strategies for a financial services firm with a four-hour recovery time objective. Which statement most accurately distinguishes a warm site from a hot site in terms of the trade-off the organisation is accepting?
- AA warm site holds preconfigured hardware and partial data feeds but lacks fully synchronised production data, exchanging a longer recovery time for a lower subscription cost than a hot site. Correct
- BA warm site keeps live replication of production workloads and fails over within minutes, so its only meaningful difference from a hot site is the contractual subscription model.
- CA warm site provides only environmental conditioning and network connectivity, leaving the organisation to procure servers and storage during the disaster declaration window.
- DA warm site is geographically closer to the primary facility than a hot site, which is what causes its recovery time to be shorter than a cold site but longer than a hot site.
Why A is correct: This captures the defining trade-off: warm sites have infrastructure ready but require data restoration and final configuration steps, so they cost less than a hot site while taking longer to bring online.
Why B is wrong: Continuous replication and near-instant failover is the hallmark of a hot site; describing the warm site this way collapses the two tiers and removes the cost-versus-time trade-off that the stem asks about.
Why C is wrong: This describes a cold site, where the building has power, cooling, and cabling but no installed compute or storage; a candidate may pick it because warm and cold are both cheaper than hot.
Why D is wrong: Site tiers are defined by readiness of equipment and data, not by proximity; in fact, regulators often require distance between primary and recovery sites to avoid shared regional risk.