CISSP Security Operations Practice Question
An organization wants to ensure that its critical database can be restored to a point within the last 15 minutes in case of failure. Which metric defines this requirement?
⚠ Common exam trap
CISSP often tests the RPO vs. RTO distinction by phrasing the question around 'point in time' or 'data loss' — candidates who read 'restore within 15 minutes' as a speed requirement pick RTO instead of RPO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RPO
RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time — i.e., how far back a restore point can be. A requirement to restore to a point within the last 15 minutes is precisely an RPO of 15 minutes, dictating backup/replication frequency. RTO, by contrast, defines how quickly service must be restored, not how much data can be lost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MTD
Why it's wrong here
MTD, or Maximum Tolerable Downtime, represents the absolute longest period a business function or system can be unavailable without causing irreparable harm to the organization. It is a critical business-driven metric that defines the upper limit for service disruption, encompassing all recovery activities. While MTD sets the overall tolerance for an outage, it does not specifically address the quantity or age of data that can be lost during such an event, making it distinct from data loss objectives.
- ✗
MTTR
Why it's wrong here
Mean Time To Repair (MTTR) is an operational metric that quantifies the average time required to repair a failed system or component and restore it to full operational status. This metric focuses on the efficiency of maintenance and recovery processes, measuring the duration from failure detection to resolution. MTTR is primarily concerned with the speed of physical or logical repair, rather than defining the acceptable amount of data loss or the total business impact of an outage.
- ✓
RPO
Why this is correct
Recovery Point Objective (RPO) precisely defines the maximum acceptable amount of data loss, measured as a period of time. It specifies the point in time to which data must be recovered, meaning any data created or modified after that point will be lost. For instance, an RPO of 15 minutes indicates that the organization can tolerate losing up to 15 minutes of data. This metric directly addresses the question's concern about ensuring an acceptable level of data loss for critical databases.
- ✗
RTO
Why it's wrong here
Recovery Time Objective (RTO) specifies the maximum acceptable duration of time within which a business process or system must be restored to an operational state after a disaster or outage. It measures the elapsed time from the incident's declaration to the point where services are available again, even if with reduced functionality. RTO focuses on the speed of service restoration and system availability, rather than the volume or recency of data that might be lost during the event.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.