CISA Practice Question: Information Systems Operations and Business Resilience
During a business impact analysis (BIA), a department manager states that their process can be disrupted for up to 8 hours, but data loss cannot exceed 15 minutes. Which two metrics are defined by these statements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery time objective (RTO) and recovery point objective (RPO)
The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mean time to repair (MTTR) and mean time between failures (MTBF)
Why it's wrong here
MTTR and MTBF are reliability statistics derived from historical failure and repair data, not the forward-looking tolerances the manager stated. They are tempting because both measure downtime, and MTTR would be the correct metric when analysing how long repairs actually take.
- ✓
Recovery time objective (RTO) and recovery point objective (RPO)
Why this is correct
The 8-hour disruption tolerance defines the recovery time objective, the maximum acceptable downtime before the process must be restored. The 15-minute data loss limit defines the recovery point objective, the maximum tolerable data loss measured backwards from the incident.
- ✗
Service level objective (SLO) and service level agreement (SLA)
Why it's wrong here
SLOs and SLAs are contractual service targets, not the disruption and data-loss tolerances the manager described. They are tempting because both quantify availability commitments, and an SLA would be the correct answer if the question asked how recovery objectives are formally agreed with a provider.
- ✗
Maximum tolerable downtime (MTD) and working recovery time (WRT)
Why it's wrong here
Working recovery time is not a recognised BIA metric; the stem's 8-hour disruption limit defines the maximum tolerable downtime, paired with the 15-minute recovery point objective for data loss. MTD is tempting because it does describe tolerable outage duration, but WRT is not its counterpart.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.