ISC2 CC Business Continuity, DR & Incident Response Practice Question
Exhibit
Backup Configuration: - Full backup: Every Sunday at 01:00 - Incremental backup: Every 4 hours - RTO: 4 hours - RPO: 1 hour
Refer to the exhibit. Which statement best describes compliance with the recovery objectives?
⚠ Common exam trap
ISC2 often tests the distinction between RTO and RPO by presenting a scenario where one objective is met and the other is not, and the trap is that candidates confuse which metric measures downtime versus data loss, leading them to incorrectly select A or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliant with RTO but not RPO
The exhibit shows the required RTO is 4 hours and the actual RTO is 4 hours, meaning the system recovers within the allowed downtime, so it is compliant with RTO. However, the backup interval is 4 hours, so the actual RPO is 4 hours, which exceeds the required RPO of 1 hour. This means up to 4 hours of data could be lost, failing RPO compliance. Therefore, the correct answer is B.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Compliant with both RTO and RPO
Why it's wrong here
The exhibit's measured recovery times exceed the stated RTO or RPO, so claiming compliance with both contradicts the figures shown. It tempts because a design can meet both objectives when actual recovery and data-loss windows fall inside their targets, which is precisely what the exhibit must demonstrate.
- ✓
Compliant with RTO but not RPO
Why this is correct
RTO likely achievable, but RPO is violated due to infrequent backups.
- ✗
Compliant with neither
Why it's wrong here
The exhibit's measured values satisfy at least one objective, so neither failing cannot hold. It is tempting when both figures appear marginal against their targets, but the calculation must compare each measured value against its own threshold independently before declaring non-compliance.
- ✗
Compliant with RPO but not RTO
Why it's wrong here
RPO is not met; RTO may be met.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.