CISSP Security and Risk Management Practice Question
During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data backups must be taken at least every 2 hours
RPO defines the maximum acceptable data loss measured in time. An RPO of 2 hours means that data can be lost up to the last 2 hours before the disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data can be recovered from any point within the past 2 hours
Why it's wrong here
This statement describes a flexible recovery capability, suggesting the ability to restore to *any* specific moment within a 2-hour window. However, the Recovery Point Objective (RPO) defines the *maximum acceptable age* of data that can be lost from an IT service due to an incident. It specifies the *single point in time* to which data must be recovered, not a continuous range of recovery points.
- ✗
The maximum tolerable downtime is 2 hours
Why it's wrong here
This statement accurately defines the Maximum Tolerable Downtime (MTD) or the Recovery Time Objective (RTO). The RTO specifies the maximum acceptable duration for a business process or system to be unavailable following a disruption, focusing on the time required to restore operations. In contrast, the Recovery Point Objective (RPO) specifically addresses the maximum amount of data loss an organization can endure, measured in time.
- ✓
Data backups must be taken at least every 2 hours
Why this is correct
A Recovery Point Objective (RPO) of 2 hours signifies that the organization can tolerate a maximum loss of 2 hours' worth of data. To achieve this objective, data backups or replication points must be created at intervals no longer than 2 hours. This ensures that, in the event of a system failure or disaster, the oldest data that might be lost would be from the last backup taken within that 2-hour window, thereby meeting the defined RPO.
- ✗
The database must be fully recovered within 2 hours of a disaster
Why it's wrong here
This statement describes the Recovery Time Objective (RTO), which is the maximum acceptable time allowed for the recovery of a business function or IT system after a disaster or disruption. The RTO focuses on the *duration of service unavailability* and the speed of restoration. The Recovery Point Objective (RPO), however, is concerned with the *amount of data loss* that is acceptable, not the time it takes to bring systems back online.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.