A security administrator is reviewing the company's continuity plan. The plan specifies an RTO of six hours and RPO of two days. Which of the following is the plan describing?

Question

Options

• ASystems should be restored within six hours and no later than two days after the incident.
• BSystems should be restored within two days and should remain operational for at least six hours.
• CSystems should be restored within six hours with a minimum of two days worth of data.
• DSystems should be restored within two days with a minimum of six hours worth of data.

• A
  5% (2)
• B
  7% (3)
• C
  86% (36)
• D
  2% (1)

Explanation

RTO (Recovery Time Objective) defines the maximum acceptable time to restore a system after an incident - here, six hours. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time - here, two days, meaning backups must capture at least two days' worth of data so no more than two days of data is lost. Option C correctly maps RTO to the restore time window (six hours) and RPO to the data retention requirement (two days worth of data). The other options incorrectly swap or misdefine these two distinct metrics.

No community discussion yet for this question.