CISA Practice Question: Information Systems Operations and Business Resilience
During a business impact analysis (BIA), the auditor identifies a critical process with a maximum tolerable downtime (MTD) of 4 hours. The IT department proposes a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 1 hour. Which statement is correct?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RTO is acceptable as it is less than the MTD
The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The MTD should be reduced to match the RTO
Why it's wrong here
Incorrect: MTD is a business requirement, not adjusted to match RTO.
- ✗
The RPO is too high because it exceeds the MTD
Why it's wrong here
RPO measures acceptable data loss in time, not downtime, so comparing it against the 4-hour MTD is dimensionally wrong; 1 hour sits comfortably inside the MTD and RTO. It tempts because RPO and MTD are both expressed in hours, making a numeric comparison look meaningful when the axes differ.
- ✓
The RTO is acceptable as it is less than the MTD
Why this is correct
The proposed Recovery Time Objective (RTO) of 2 hours is acceptable because it directly satisfies the critical business continuity constraint established by the Maximum Tolerable Downtime (MTD) of 4 hours. For any recovery strategy to be effective, the RTO, representing the target time to restore operations, must always be less than or equal to the MTD. This ensures that the process can resume before the organisation incurs unacceptable losses, which is met in this scenario.
- ✗
The RTO should be equal to the MTD
Why it's wrong here
RTO is the target time to restore the process, and it must be less than or equal to the MTD, not equal to it; a 2-hour RTO already satisfies the 4-hour MTD. Equating them tempts because both measure downtime tolerance, but equality would leave no recovery margin.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.