CISSP Maximum Tolerable Downtime (MTD) Practice Question
An organization has a maximum tolerable downtime (MTD) of 8 hours for its critical e-commerce platform. The recovery time objective (RTO) is set to 4 hours, and the recovery point objective (RPO) is 30 minutes. Which disaster recovery strategy is most cost-effective while meeting these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud DR with continuous replication
Cloud DR with continuous replication meets the RPO of 30 minutes because data is replicated in near real-time, resulting in minimal data loss. It can also meet the RTO of 4 hours if automated failover and resource provisioning are configured. This approach is more cost-effective than a hot site because it avoids maintaining idle infrastructure and only incurs costs during actual disaster recovery operations. Hot site with real-time replication (option B) also meets the requirements but is more expensive. Cold site with daily backups (option C) fails both RTO and RPO. Warm site with hourly backups (option D) fails RPO because it can result in up to 1 hour of data loss, exceeding the 30-minute limit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud DR with continuous replication
Why this is correct
This option is correct because continuous replication ensures near-zero data loss, effectively meeting the stringent 30-minute Recovery Point Objective (RPO). Leveraging cloud-based Disaster Recovery (DR) allows for rapid provisioning of resources and pre-configured environments, which can be activated to meet the 4-hour Recovery Time Objective (RTO). Furthermore, cloud DR typically offers a more cost-effective solution compared to maintaining a dedicated physical hot site, making it an optimal choice that satisfies all technical and financial requirements.
- ✗
Hot site with real-time replication
Why it's wrong here
While a hot site with real-time replication can certainly meet both the 30-minute Recovery Point Objective (RPO) and the 4-hour Recovery Time Objective (RTO) due to its fully equipped and continuously updated nature, it is not the most suitable choice in this context. The significant drawback is the substantially higher operational cost associated with maintaining a dedicated, fully redundant, and always-on physical infrastructure. This makes it a less cost-effective solution compared to cloud-based alternatives that offer similar performance objectives through a pay-as-you-go model.
- ✗
Cold site with daily backups
Why it's wrong here
This option is incorrect as it fails to meet both the Recovery Point Objective (RPO) and the Recovery Time Objective (RTO). Daily backups inherently mean that up to 24 hours of data could be lost in a disaster, far exceeding the required 30-minute RPO. Additionally, a cold site, which is essentially an empty facility, requires significant time to acquire, install, and configure hardware and software, making it impossible to restore services within the 4-hour RTO; recovery typically spans days or even weeks.
- ✗
Warm site with hourly backups
Why it's wrong here
This option is incorrect because it fails to meet the critical Recovery Point Objective (RPO). Hourly backups, by their very nature, mean that up to 60 minutes (1 hour) of data could be lost in the event of a disaster. This directly violates the specified requirement for a 30-minute RPO, which demands a much more frequent or continuous data synchronization strategy. While a warm site might offer a quicker RTO than a cold site, the backup frequency alone renders this option unsuitable for the given RPO.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Maximum tolerable downtime
Maximum tolerable downtime (MTD) is the total amount of time a business process or system can be unavailable before causing irreparable harm to the organization.
Key term
MTD
MTD (Maximum Tolerable Downtime) is the longest period a business can function without a specific system or service before the damage becomes unacceptable.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.