CISA Practice Question: Information Systems Operations and Business Resilience
During a business impact analysis (BIA), which of the following is the MOST important metric to identify for each critical business process?
⚠ Common exam trap
The trap is selecting RTO or RPO as the most important, but MTD is the business-driven metric that sets the stage for all others.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Maximum Tolerable Downtime (MTD)
Maximum Tolerable Downtime (MTD) is the most important metric because it defines the maximum time a business process can be unavailable before causing unacceptable consequences. It sets the upper bound for recovery objectives like RTO and WRT. Without knowing MTD, other metrics lack context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recovery Point Objective (RPO)
Why it's wrong here
RPO defines tolerable data loss, which matters for data-centric processes but does not express how long the business can survive an outage. It is tempting because RPO is a core BIA metric, yet RTO is the one that determines maximum tolerable downtime and therefore recovery priority for each process.
- ✗
Work Recovery Time (WRT)
Why it's wrong here
WRT measures time to restore data and resume processing after systems are recovered, a derived figure rather than the primary BIA output. It is tempting because it quantifies operational downtime, but BIA first establishes RTO and RPO for each process; WRT is calculated later during recovery planning.
- ✓
Maximum Tolerable Downtime (MTD)
Why this is correct
MTD defines the longest a process can be unavailable before unacceptable business impact occurs, directly setting the recovery time objective and driving continuity strategy. During a BIA, it is the primary metric quantifying tolerable outage per critical process, making it the most important figure to establish.
- ✗
Recovery Time Objective (RTO)
Why it's wrong here
RTO states how quickly a process must be restored, but the BIA's primary metric is the maximum tolerable downtime, from which RTO is derived. It tempts because RTO drives recovery strategy selection once MTD is established.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.