Capacity And Recovery Testing for Security+
Short answer
Resilience fails when the recovery design lacks capacity. Capacity planning is more than buying servers. People capacity asks whether enough trained staff are available during an outage, whether roles have backups, whether vendors can respond, and whether teams can work extended incidents without single-person dependency. Technology capacity asks whether systems can handle peak traffic, failover load, restored workloads, logging volume, authentication demand, backup throughput, and monitoring.
Why it appears on the exam
SY0-701 3.4: Explain capacity planning for people, technology, and infrastructure plus tabletop, failover, simulation, and parallel-processing tests.
Key concepts
Concept 1
Required terms
Capacity planning: estimating and preparing enough resources to support normal, peak, degraded, and recovery operations. People: staff, skills, shifts, alternates, decision makers, vendors, and support coverage needed during disruption or recovery. Technology: systems, applications, licenses, compute, storage, network services, identity services, monitoring, and tools needed to operate or recover. Infrastructure: facilities, power, cooling, connectivity, hardware, cloud capacity, physical access, and environmental support.
Example
A recovery site has servers but not enough licensed database capacity to support production load. That is a technology capacity planning gap.
Concept 2
How Capacity And Recovery Testing works
Resilience fails when the recovery design lacks capacity. Capacity planning is more than buying servers. People capacity asks whether enough trained staff are available during an outage, whether roles have backups, whether vendors can respond, and whether teams can work extended incidents without single-person dependency. Technology capacity asks whether systems can handle peak traffic, failover load, restored workloads, logging volume, authentication demand, backup throughput, and monitoring.
Example
Only one engineer knows how to restore the identity platform. That is a people capacity gap.
Concept 3
Common confusion
Learners often call every recovery test a simulation. The correction is to identify the test goal: discussion is tabletop, service transfer is failover, modeled event is simulation, and side-by-side operation is parallel processing. Another common mistake is treating capacity as only technology; people and infrastructure capacity are equally testable gaps.
Example
A company gathers leaders to walk through a ransomware outage and identify decision points. That is a tabletop exercise.
Concept 4
What to recognize
Identify capacity planning gaps involving people, technology, or infrastructure; Choose tabletop exercise for role, communication, and decision walkthroughs; Choose failover testing for validating a switch to secondary systems or sites; Choose simulation for modeled events or controlled emulation of disruption.
Example
A team intentionally shifts a customer portal from the primary region to the secondary region during a maintenance window. That is failover testing.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A security team sees this situation: A recovery site has servers but not enough licensed database capacity to support production load. That is a technology capacity planning gap. Which concept applies?
Q2.A security question includes this clue: Only one engineer knows how to restore the identity platform. That is a people capacity gap. Which term is being tested?
Q3.A Security+ scenario describes this situation: A recovery site has servers but not enough licensed database capacity to support production load. That is a technology capacity planning gap. Which answer fits best?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8