CISA Practice Question: Information Systems Operations and Business Resilience
An organization is developing a business continuity strategy for its key customer-facing application. The BIA determined an RTO of 2 hours and an RPO of 30 minutes. Which TWO strategies are most appropriate to meet these objectives?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a hot standby site
Option A (hot standby site) is correct because a hot standby keeps a fully operational, continuously synchronized environment ready to take over immediately, so the 2-hour RTO can be met with minimal failover time. Option D (synchronous data replication to a secondary site) is correct because synchronous replication commits writes to the secondary site before acknowledging them, giving an RPO of effectively zero, which is well within the required 30-minute RPO. Option B (manual workaround process) is not appropriate because manual procedures typically introduce delays and human error that cannot reliably satisfy a 2-hour RTO. Option C (offsite tape storage) does not belong because retrieving and restoring tapes takes far longer than 2 hours and cannot meet a 30-minute RPO. Option E (daily full backups to tape) is unsuitable because a 24-hour backup interval yields an RPO of up to 24 hours, far exceeding the 30-minute requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a hot standby site
Why this is correct
A hot standby site maintains continuously synchronised infrastructure with near-zero data loss, comfortably satisfying the 30-minute RPO and 2-hour RTO. Because systems run live and replicate in real time, failover completes within minutes, unlike warm or cold alternatives requiring rebuild time that would breach both objectives.
- ✗
Adopt a manual workaround process
Why it's wrong here
A manual workaround cannot sustain a customer-facing application within a 2-hour RTO or 30-minute RPO, since manual re-entry loses transactions and cannot match the required data currency. It is tempting because manual procedures suit non-critical functions during short outages, where automated recovery is not justified.
- ✗
Store backup tape at an offsite location
Why it's wrong here
Offsite tape storage cannot restore within a 2-hour RTO or 30-minute RPO; retrieval and shipping alone exceed both targets. It is tempting because offsite copies protect against site loss, and it would be the correct choice for long-term archival retention or a low-RTO, low-RPO disaster recovery tier.
- ✓
Use synchronous data replication to a secondary site
Why this is correct
Synchronous replication writes to both sites before acknowledging the transaction, giving an RPO of zero — comfortably inside the 30-minute limit. However, it demands low-latency links and can slow the application, so it satisfies the RPO but must be paired with a strategy meeting the 2-hour RTO.
- ✗
Perform daily full backups to tape
Why it's wrong here
Daily full backups to tape give a 24-hour RPO, far exceeding the 30-minute target, and tape restore times breach the 2-hour RTO. It is tempting because full backups are a standard data protection baseline, and would be correct where the BIA permits an RPO measured in hours or a day.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.