hardMultiple ChoiceObjective-mapped
CISA Practice Question: A healthcare organization is required to comply…
A healthcare organization is required to comply with HIPAA regulations for data backup and disaster recovery. They operate a primary data center and a colocation facility for disaster recovery. The current backup strategy involves nightly full backups to tape, which are stored off-site monthly. The recovery time for the electronic health record (EHR) system is estimated at 8 hours, but the RTO required by the business is 2 hours. Additionally, the RPO requirement is 15 minutes. The IT manager proposes implementing a continuous data protection (CDP) solution. However, the CFO is concerned about the cost. Which of the following is the BEST argument to justify the CDP investment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CDP can achieve an RPO of seconds and significantly reduce recovery time.
CDP provides near-zero RPO and can significantly reduce recovery time, directly meeting the RTO and RPO requirements. Option B is false because HIPAA does not mandate CDP. Option C is misleading; CDP does not necessarily reduce IT staff, as it may require continuous monitoring and management. Option D is false because CDP still requires off-site storage or replication for disaster recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CDP can achieve an RPO of seconds and significantly reduce recovery time.
Why this is correct
CDP can achieve an RPO of seconds and significantly reduce recovery time, directly meeting the 2-hour RTO and 15-minute RPO requirements.
- ✗
CDP is required by HIPAA for all healthcare systems.
Why it's wrong here
HIPAA does not mandate CDP; it requires reasonable and appropriate administrative, physical, and technical safeguards, but not a specific technology.
- ✗
CDP will reduce the need for IT staff to perform backups.
Why it's wrong here
While CDP can reduce manual backup efforts, it does not eliminate IT staff involvement entirely; the primary justification is meeting RTO/RPO.
- ✗
CDP eliminates the need for any off-site storage, reducing costs.
Why it's wrong here
CDP does not eliminate off-site storage; it still requires off-site copies for disaster recovery to protect against site-level failures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.