A disaster-recovery exercise restores servers but excludes application transactions. What is the main assessment gap?

1. Testing can now stop permanently
2. The exercise proves all RTOs were achieved
3. Business service recoverability has not been demonstrated
4. Backup encryption has necessarily failed