ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
A financial services firm has a recovery time objective (RTO) of 2 hours for its trading platform and a recovery point objective (RPO) of 15 minutes. The disaster recovery team is evaluating whether a warm site can meet these requirements. Which statement best describes the limitation of a warm site in this scenario?
⚠ Common exam trap
The trap here is focusing on the RPO and assuming replication alone makes a warm site adequate, when the 2-hour RTO is the more demanding constraint that a warm site usually cannot satisfy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A warm site cannot meet the RTO because it requires manual data restoration and configuration, which typically takes longer than 2 hours.
A warm site provides pre-installed hardware and network connectivity but requires data restoration and system configuration before it can operate. For a trading platform with a 2-hour RTO, this manual effort typically exceeds the acceptable outage window. While the 15-minute RPO could be addressed with replication, the RTO is the binding constraint that makes a warm site a poor fit without substantial automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A warm site cannot meet the RPO because it does not support data replication from the primary site.
Why it's wrong here
A warm site can support data replication; the limitation is not the absence of replication technology but the state of the site. It may receive replicated data, but the systems are not fully configured or running with live data. The RPO of 15 minutes could be met if replication is in place, so the RPO is not the primary limitation here; the recovery time is the greater challenge.
- ✗
A warm site can meet the RTO because it only requires switching network routes to the standby environment.
Why it's wrong here
Switching network routes alone is insufficient for a warm site. Even if connectivity exists, the servers may not have the latest data or may need to be powered on, patched, and configured. The trading platform's 2-hour RTO demands a near-instant failover, which a warm site cannot provide without significant pre-configuration and data synchronization, effectively requiring hot-site capabilities.
- ✗
A warm site is identical to a hot site and can meet both the RTO and RPO without any additional configuration.
Why it's wrong here
A warm site is not identical to a hot site. A hot site is fully configured with live data and can take over almost immediately, while a warm site requires some setup and data restoration. Claiming they are identical misrepresents the tiers of recovery sites and would lead to a false sense of readiness for the trading platform's stringent 2-hour RTO.
- ✓
A warm site cannot meet the RTO because it requires manual data restoration and configuration, which typically takes longer than 2 hours.
Why this is correct
A warm site has hardware and connectivity pre-installed but lacks live data and may need manual restoration and configuration. For a trading platform with a 2-hour RTO, the time to restore data, apply configurations, and validate systems often exceeds that window. This makes a warm site unsuitable unless extensive automation and replicated data are added, which would effectively turn it into a hot site.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
RTO
Recovery Time Objective is the maximum acceptable time to restore a system or data after a disaster, defining how quickly normal operations must resume.
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.