easyMultiple Choice
ISC2 CC Practice Question: Wants to ensure that a critical database can be…
An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?
⚠ Common exam trap
CC often tests the RTO vs RPO distinction — candidates pick RPO because both involve recovery, but RPO is about acceptable data loss (time), while RTO is about acceptable downtime duration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery Time Objective (RTO)
Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or service after a disruption. A requirement to restore a critical database within 2 hours is exactly an RTO. RTO drives backup, replication, and failover design decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Maximum Tolerable Downtime (MTD)
Why it's wrong here
MTD is the total downtime the business can tolerate.
- ✗
Service Level Agreement (SLA)
Why it's wrong here
An SLA is a contractual document specifying expected service levels and remedies, not a technical recovery metric. It is tempting because SLAs often quote recovery commitments, but the organisation needs a measurable objective defining the two-hour restoration target itself, which an SLA would merely reference.
- ✗
Recovery Point Objective (RPO)
Why it's wrong here
RPO defines the maximum acceptable data loss measured backwards from the failure, expressed as a time interval, not the two-hour restoration duration. It is tempting because both are recovery metrics, but RPO would be correct when specifying how much transactional data the database can afford to lose.
- ✓
Recovery Time Objective (RTO)
Why this is correct
Recovery Time Objective defines the maximum acceptable duration to restore the database after disruption. Specifying an RTO of two hours directly translates the stated restoration constraint into a measurable target that drives backup, replication and failover design.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.