Business Continuity, Disaster Recovery, and Incident Response →mediumMultiple SelectObjective-mapped
ISC2 CC Recovery Time Objective (RTO) Practice Question
A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?
⚠ Common exam trap
MTD and RTO are sometimes confused: MTD is the maximum acceptable downtime from the business perspective, while RTO is the target recovery time set by the organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.
In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.
Why it's wrong here
Service Level Agreement (SLA) is a contractual commitment, not a BIA metric. Incorrect.
- ✓
Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.
Why this is correct
Recovery Time Objective (RTO) is correctly defined as the maximum time to restore a business function after disruption. Correct.
- ✓
Maximum Tolerable Downtime (MTD) – the total time a business function can be unavailable before causing irreparable harm.
Why this is correct
Maximum Tolerable Downtime (MTD) is correctly defined as the total time a business function can be unavailable before causing irreparable harm. Correct.
- ✗
Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.
Why it's wrong here
Annualized Loss Expectancy (ALE) is a risk assessment metric from quantitative risk analysis, not a BIA metric. Incorrect.
- ✓
Recovery Point Objective (RPO) – the maximum acceptable amount of data loss measured in time.
Why this is correct
Recovery Point Objective (RPO) is correctly defined as the maximum acceptable amount of data loss measured in time. Correct.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.