ISC2 CC Security Principles Practice Question
A security manager is developing a disaster recovery plan for a critical database. The manager needs to determine the maximum tolerable downtime (MTD) for the database. Which of the following should the manager consider FIRST when establishing the MTD?
⚠ Common exam trap
It's easy for candidates to confuse MTD with RTO or RPO, but MTD is a business-driven metric that defines the maximum tolerable downtime, not a technical recovery target.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The business impact of the database being unavailable
The maximum tolerable downtime (MTD) is the longest time an organization can tolerate a system being unavailable before unacceptable consequences occur. To establish MTD, the manager must first conduct a business impact analysis to understand the consequences of downtime. This includes financial, operational, and reputational impacts. Once MTD is known, the recovery time objective (RTO) can be set to ensure recovery occurs within that window. Cost, RTO, and RPO are all important but are not the primary driver for MTD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The business impact of the database being unavailable
Why this is correct
The MTD is determined by analyzing the business impact of downtime. This includes financial losses, regulatory penalties, reputational damage, and operational disruptions. By understanding the consequences of unavailability, the manager can establish how long the organization can survive without the database. This business impact analysis is the foundation for setting MTD, which then drives the RTO and recovery strategies.
- ✗
The cost of implementing redundant hardware
Why it's wrong here
While cost is a factor in disaster recovery planning, it is not the first consideration when establishing MTD. MTD is driven by business needs and the impact of downtime on the organization. The cost of redundant hardware is a solution consideration that comes after determining how long the business can tolerate the database being unavailable. Therefore, it is not the primary factor.
- ✗
The recovery time objective (RTO) of the database
Why it's wrong here
The RTO is the target time within which the database must be restored after a disruption. MTD is the maximum time the business can tolerate downtime before unacceptable consequences occur. MTD is typically greater than or equal to RTO. The RTO is derived from the MTD, not the other way around. Therefore, the RTO is not the first consideration when establishing MTD; rather, MTD informs the RTO.
- ✗
The recovery point objective (RPO) of the database
Why it's wrong here
The RPO defines the maximum acceptable amount of data loss measured in time. It is a separate metric from MTD, focusing on data loss rather than downtime. While important for disaster recovery, RPO does not determine MTD. MTD is about how long the business can tolerate the database being down, not how much data can be lost. Therefore, RPO is not the first consideration for MTD.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
MTD
MTD (Maximum Tolerable Downtime) is the longest period a business can function without a specific system or service before the damage becomes unacceptable.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.