ISC2 CC Business Continuity, DR & Incident Response Practice Question
An organization's business continuity plan (BCP) requires that its payroll system be operational within 8 hours of a disruption, but the system can tolerate losing up to 4 hours of payroll transaction data. Which pair of metrics BEST represents these two requirements?
⚠ Common exam trap
The trap here is assuming the larger time value must be the RPO, when in fact the metric is determined by what is being measured (downtime versus data loss), not by which number is bigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RTO = 8 hours; RPO = 4 hours
The recovery time objective (RTO) is the maximum acceptable time to restore a system after disruption, so the 8-hour restoration requirement maps to RTO. The recovery point objective (RPO) is the maximum acceptable data loss expressed in time, so the 4-hour data-loss tolerance maps to RPO. These two metrics together define how quickly the payroll system must return and how much payroll data the organization can afford to lose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RPO = 8 hours; MTD = 4 hours
Why it's wrong here
Neither assignment fits. A recovery point objective measures tolerable data loss, but 8 hours is the stated system restoration time, which is an RTO. The maximum tolerable downtime measures how long the business function can be unavailable, yet 4 hours is the stated data-loss tolerance, which is an RPO. This pairing inverts both definitions and would produce an inaccurate continuity plan.
- ✗
RTO = 4 hours; RPO = 8 hours
Why it's wrong here
This reverses the two metrics. The 8-hour figure describes how long the payroll system may remain unavailable, which is the RTO, not the RPO. The 4-hour figure describes acceptable data loss, which is the RPO, not the RTO. Assigning them this way would misstate the recovery priorities and mislead recovery teams during an actual disruption.
- ✗
MTD = 8 hours; RTO = 4 hours
Why it's wrong here
The maximum tolerable downtime (MTD) is the total time a business can survive without the payroll function before unacceptable consequences occur, which is typically longer than the RTO. The scenario gives an 8-hour restoration requirement, not an MTD, and a 4-hour data-loss tolerance, not an RTO. Using MTD here conflates business tolerance with technical recovery targets.
- ✓
RTO = 8 hours; RPO = 4 hours
Why this is correct
The recovery time objective (RTO) defines the maximum acceptable time to restore the payroll system after a disruption, which matches the 8-hour requirement. The recovery point objective (RPO) defines the maximum acceptable data loss measured in time, which matches the 4-hour tolerance. Together they correctly capture both the downtime and data-loss constraints stated in the BCP.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
Business continuity plan
A Business continuity plan (BCP) is a documented strategy that outlines how an organization will continue critical operations during and after a disruptive event.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.