SY0-701 Security Program Management and Oversight Practice Question
During business impact analysis interviews, the team needs two inputs that help determine which business services must recover first after an outage. Which two inputs are the most useful? Select two.
⚠ Common exam trap
CompTIA often tests the confusion between RTO/RPO as recovery metrics versus ALE/MTBF as risk or reliability metrics, leading candidates to select ALE because it involves financial loss, when the question specifically asks for inputs to determine recovery priority.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery Time Objective (RTO)
Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, directly indicating the urgency of recovery. Recovery Point Objective (RPO) defines the maximum acceptable data loss, which influences the recovery strategy and priority. Together, they provide the two critical inputs needed to sequence recovery efforts after an outage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recovery Time Objective (RTO)
Why this is correct
Recovery Time Objective (RTO) is the maximum acceptable delay between an interruption and service restoration, as determined by the business impact analysis (BIA). It directly quantifies the urgency of recovery, setting the target time within which critical functions must resume to avoid unacceptable consequences. In outage scenarios, RTO is used to prioritize which systems are brought back first.
- ✗
Annualized Loss Expectancy (ALE)
Why it's wrong here
Annualized Loss Expectancy (ALE) is a financial metric that combines the annualized rate of occurrence with the single loss expectancy to quantify expected monetary loss per year. While useful for cost-benefit analysis and risk mitigation investments, it does not define operational recovery priorities or time-based targets during an outage. ALE speaks to economic impact, not the sequence or speed of restoration needed.
- ✗
Mean Time Between Failures (MTBF)
Why it's wrong here
Mean Time Between Failures (MTBF) is a reliability statistic that averages the elapsed time between inherent failures of a system during normal operation. It is used to forecast component lifetimes and schedule preventive maintenance, but it is not an input to business impact analysis. MTBF measures how often something breaks, not how quickly or in what order it must be recovered after an outage.
- ✓
Recovery Point Objective (RPO)
Why this is correct
Recovery Point Objective (RPO) is the maximum tolerable amount of data loss, expressed as a time interval before the interruption. It dictates backup frequency and replication strategy, ensuring that recovery can restore data to an acceptable point in time. RPO complements RTO: RPO addresses data loss while RTO addresses downtime, and both are derived from BIA stakeholder interviews.
- ✗
Control self-assessment score
Why it's wrong here
A control self-assessment score is a subjective or semi-quantitative evaluation of the effectiveness of internal security or compliance controls. It may highlight maturity gaps or audit readiness, but it does not measure the business impact of a disruption or set recovery targets. BIA relies on impact-driven metrics like RTO and RPO, not control performance scores, to define recovery priorities.
Go deeper
Related to this question
Learn chapter
Risk Assessment and Analysis
Key term
RTO
Recovery Time Objective is the maximum acceptable time to restore a system or data after a disaster, defining how quickly normal operations must resume.
Key term
Business impact analysis
A systematic process used to identify and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.