ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?
⚠ Common exam trap
CC often tests the distinction between RTO and WRT, and candidates may incorrectly assume that meeting RTO means full recovery, ignoring the additional time needed for business operations to resume.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Work Recovery Time (WRT)
Work Recovery Time (WRT) is the time required to restore business operations after systems are technically recovered. In this scenario, systems were restored within RTO, but users could not resume work due to additional configuration and data validation, meaning WRT was not met. Therefore, WRT is the metric not met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recovery Point Objective (RPO)
Why it's wrong here
RPO concerns data loss, not the additional time after restoration.
- ✓
Work Recovery Time (WRT)
Why this is correct
WRT is the time needed after systems are restored to validate data and resume normal business operations. Meeting RTO restored the systems, but the outstanding configuration and validation work means WRT was not met, so users could not resume work.
- ✗
Maximum Tolerable Downtime (MTD)
Why it's wrong here
MTD is the total time a business can survive an outage before unacceptable harm; the team met RTO and restored systems, so MTD was not breached. It is tempting because users could not work, but the unmet metric concerns data currency and completeness, not elapsed downtime.
- ✗
Recovery Time Objective (RTO)
Why it's wrong here
The stem states the team achieved the RTO, so it cannot be the unmet metric. It is tempting because RTO concerns restoration time and systems were restored, yet the failure was that users still could not resume work, which is measured by a different recovery objective.
Go deeper
Related to this question
Learn chapter
Security Operations Basics
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Disaster recovery
Disaster recovery is a set of policies, procedures, and tools that help an organization restore critical IT systems and data after a disruptive event.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.