200-201 Security Policies and Procedures Practice Question
A security manager is developing a business continuity plan (BCP) for a critical e-commerce application. The application has a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The manager must choose a backup strategy that meets these objectives. Which strategy is most appropriate?
⚠ Common exam trap
The trap here is selecting a backup strategy based on cost or simplicity without checking whether it satisfies both the RTO and RPO, especially the 15-minute RPO which requires near-real-time replication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Continuous data replication to a hot site with automated failover.
The RTO of 4 hours requires recovery within that time, and the RPO of 15 minutes requires minimal data loss. Continuous replication to a hot site with automated failover can achieve both by keeping data synchronized and enabling rapid switchover. Other strategies like nightly, weekly, or daily backups introduce too much data loss and longer recovery times, failing to meet the objectives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weekly incremental backups to a warm site with manual failover.
Why it's wrong here
Weekly incremental backups would result in significant data loss, violating the 15-minute RPO. A warm site with manual failover typically takes longer than 4 hours to activate. This strategy is inadequate for critical e-commerce where rapid recovery is essential. It might be acceptable for non-critical applications but not for this scenario.
- ✓
Continuous data replication to a hot site with automated failover.
Why this is correct
Continuous replication keeps the recovery site synchronized with minimal data loss, meeting the 15-minute RPO. A hot site with automated failover can bring the application online within the 4-hour RTO. This strategy provides the highest availability and is suitable for critical e-commerce. It aligns with both objectives by minimizing downtime and data loss.
- ✗
Daily differential backups to a cold site with tape restoration.
Why it's wrong here
Daily differential backups allow up to 24 hours of data loss, missing the 15-minute RPO. A cold site requires infrastructure setup and tape restoration, which typically takes days, not hours. This strategy is the least appropriate for meeting tight RTO and RPO. It is often used for disaster recovery when downtime is acceptable.
- ✗
Nightly full backups stored offsite with manual restore.
Why it's wrong here
Nightly backups mean up to 24 hours of data loss, far exceeding the 15-minute RPO. Manual restore from offsite tapes would likely exceed the 4-hour RTO. This strategy is cost-effective but does not meet the stringent objectives of a critical e-commerce application. It is more suitable for less critical systems with longer RTO and RPO.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.