CISSP Security Operations Practice Question
An organization's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours for its critical financial application. Which disaster recovery site would be MOST appropriate to meet this RTO?
⚠ Common exam trap
Many exam-takers confuse a warm site with a hot site, assuming pre-installed hardware is sufficient, but they overlook the critical need for current data replication to meet a tight RTO like 4 hours.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hot site
A hot site is fully configured with hardware, software, and real-time data replication, enabling the critical financial application to be operational within minutes to a few hours. With an RTO of 4 hours, a hot site provides the necessary infrastructure and up-to-date data to meet this stringent recovery timeline, as cold and warm sites require significant setup and data restoration time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reciprocal agreement
Why it's wrong here
A reciprocal agreement involves two organizations agreeing to provide backup facilities for each other in a disaster. However, this arrangement rarely guarantees immediate availability or specific recovery time objectives (RTOs) because the other organization may also be experiencing issues or have its own critical operations to prioritize. Furthermore, legal and logistical complexities, including differing hardware/software configurations and security requirements, often make this an unreliable primary disaster recovery strategy for stringent RTOs.
- ✗
Warm site
Why it's wrong here
A warm site is a partially equipped facility with necessary hardware and network connectivity, but it lacks current data and may require significant configuration and data restoration efforts. While it can be brought online within hours, this setup time typically exceeds stringent recovery time objectives (RTOs) that demand immediate operational resumption. The need to install applications, restore recent backups, and perform extensive testing means it cannot guarantee near-instantaneous recovery.
- ✗
Cold site
Why it's wrong here
A cold site is a basic facility with essential utilities like power and cooling, but it contains no hardware, software, or network infrastructure. Bringing a cold site online requires procuring, installing, and configuring all necessary equipment, along with restoring data, which can take days or even weeks. This extensive lead time makes a cold site unsuitable for organizations with critical systems requiring rapid recovery time objectives (RTOs) measured in minutes or a few hours.
- ✓
Hot site
Why this is correct
A hot site is a fully operational, mirror image of the primary data center, equipped with all necessary hardware, software, and up-to-date data. It maintains real-time or near real-time synchronization with the production environment, allowing for immediate failover and seamless business continuity with minimal disruption. This immediate availability and readiness directly address stringent recovery time objectives (RTOs) that demand near-instantaneous resumption of critical operations following a disaster.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.