CISA Practice Question: Information Systems Operations and Business Resilience
An organization has defined an RTO of 4 hours for its critical financial system. During a disaster recovery test, the system was recovered in 3.5 hours, but data loss was 30 minutes. Which metric is most directly addressed by the recovery time?
⚠ Common exam trap
Many exam-takers confuse RTO with RPO: candidates see 'data loss was 30 minutes' and incorrectly assume the recovery time metric is RPO, but the question explicitly asks which metric is 'most directly addressed by the recovery time,' which is RTO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RTO
The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RPO
Why it's wrong here
RPO defines the maximum tolerable data loss measured in time, so the 30-minute loss addresses RPO, not the 3.5-hour recovery. It is tempting because both metrics appear in the same test result, and it would be correct if the question asked which metric the data loss satisfies.
- ✗
MTBF
Why it's wrong here
MTBF measures the average interval between failures of a repairable system, so it says nothing about how long recovery takes. It is tempting because it is a core availability metric, and it would be the right choice when assessing component reliability or failure frequency rather than the elapsed restoration time against an RTO.
- ✓
RTO
Why this is correct
RTO defines the maximum tolerable time to restore the system after disruption. Recovery completed in 3.5 hours, within the 4-hour target, so the recovery time directly addresses RTO; the 30-minute data loss relates instead to RPO.
- ✗
MTTR
Why it's wrong here
MTTR measures the mean time to repair a failed component, not the elapsed recovery duration measured against an RTO. It is tempting because recovery and repair sound alike, but MTTR applies to incident restoration averages in availability reporting, whereas the stem's 3.5-hour figure is directly compared with the 4-hour RTO.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.