hardMultiple Choice
CISA Practice Question: A healthcare organization is required to comply…
A healthcare organization is required to comply with HIPAA regulations for data backup and disaster recovery. They operate a primary data center and a colocation facility for disaster recovery. The current backup strategy involves nightly full backups to tape, which are stored off-site monthly. The recovery time for the electronic health record (EHR) system is estimated at 8 hours, but the RTO required by the business is 2 hours. Additionally, the RPO requirement is 15 minutes. The IT manager proposes implementing a continuous data protection (CDP) solution. However, the CFO is concerned about the cost. Which of the following is the BEST argument to justify the CDP investment?
⚠ Common exam trap
CISA often tests whether candidates confuse a regulatory mandate with a business justification — HIPAA does not require CDP, so the correct answer must tie CDP to the specific RTO/RPO gaps, not to a nonexistent regulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CDP can achieve an RPO of seconds and significantly reduce recovery time.
CDP continuously captures every write at the block or transaction level, enabling RPO in seconds and dramatically shortening recovery time compared to nightly tape backups. This directly satisfies the stated 15-minute RPO and helps close the gap toward the 2-hour RTO, making it the strongest business justification. The argument is framed around measurable recovery objectives, which is what the CFO needs to approve spend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CDP can achieve an RPO of seconds and significantly reduce recovery time.
Why this is correct
CDP journals every write at block level, so recovery can resume from any point, delivering an RPO of seconds rather than the 15-minute target. That granularity also shortens recovery, since restoring from near-real-time replicas avoids tape retrieval and full restores, closing the 8-hour versus 2-hour RTO gap.
- ✗
CDP is required by HIPAA for all healthcare systems.
Why it's wrong here
HIPAA requires contingency planning, backup and disaster recovery, but mandates no specific technology such as CDP. Claiming a regulatory obligation invents a requirement and would not persuade the CFO. CDP would be justified by the 15-minute RPO and 2-hour RTO, not by a HIPAA technology mandate.
- ✗
CDP will reduce the need for IT staff to perform backups.
Why it's wrong here
CDP still requires administration, monitoring, storage management and periodic recovery testing, so staff effort is not eliminated. The compelling justification is meeting the 15-minute RPO and 2-hour RTO. Reduced manual backup effort would be a legitimate benefit in environments where staffing, not recovery objectives, drives the decision.
- ✗
CDP eliminates the need for any off-site storage, reducing costs.
Why it's wrong here
CDP replicates data continuously to a secondary site or repository; it does not remove the need for off-site copies, and HIPAA contingency planning still expects them. The cost argument therefore misstates the architecture. Eliminating off-site storage would be valid only where no geographic separation or retention obligation applied.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.