Match each business continuity term to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Maximum acceptable downtime after a disaster
Maximum acceptable data loss measured in time
Average time between system failures
Average time to repair a failed system
Service level agreement defining performance metrics
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
RTO: The maximum amount of time a system or application can be down after a disaster without causing significant damage to the business.
Correct matches: RTO defines the acceptable downtime; RPO defines acceptable data loss; MTD is the total tolerable downtime; BIA is the analysis process identifying critical functions. Common confusions involve swapping time-based metrics (RTO/RPO/MTD) or misapplying process terms (BIA).
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
RTO: The maximum amount of time a system or application can be down after a disaster without causing significant damage to the business.
Why this is correct
The Recovery Time Objective (RTO) specifies the maximum allowable duration for a system, application, or business process to be unavailable following a disruptive event before unacceptable consequences arise. It quantifies the target time within which a business function must be restored to operational status, directly influencing the choice of recovery strategies and technologies. This metric is crucial for defining the urgency of recovery efforts and resource allocation post-disaster.
RPO: The maximum age of data that an organization can lose during a disaster without causing significant business damage.
Why this is correct
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate during a disaster. It represents the point in time to which data must be recovered, meaning any data created or modified after this point is considered lost. This objective directly impacts backup frequency, replication strategies, and data archiving policies, ensuring that data recovery aligns with business tolerance for information loss.
MTD: The total time a business process can be unavailable before causing irreparable harm.
Why this is correct
The Maximum Tolerable Downtime (MTD), also known as Maximum Allowable Downtime (MAD), represents the absolute longest period a business process can be inoperative before the organization experiences severe, potentially irreparable, damage. Unlike RTO, which is a target for recovery, MTD is the ultimate threshold of business process unavailability. It encompasses the RTO and any subsequent recovery activities, serving as the critical limit beyond which the business viability is fundamentally threatened.
BIA: A process that identifies critical business functions and the impact of disruptions on them.
Why this is correct
A Business Impact Analysis (BIA) is a systematic process used to identify and evaluate the potential effects of an interruption to critical business operations and processes. It quantifies the financial and non-financial impacts of disruptions, such as lost sales, regulatory fines, or reputational damage, and determines the criticality of various functions. The BIA is foundational for establishing recovery priorities and setting appropriate RTOs and RPOs for systems supporting these functions.
RTO: The maximum age of data that an organization can lose during a disaster without causing significant business damage.
Why it's wrong here
This definition incorrectly describes the Recovery Time Objective (RTO). The RTO specifically pertains to the maximum duration a system or business process can be down before significant damage occurs, focusing on the time to *restore* functionality. Conversely, the provided definition, 'the maximum age of data that an organization can lose,' accurately defines the Recovery Point Objective (RPO), which addresses acceptable data loss rather than system uptime.
BIA: The maximum time to recover a business process after a disaster.
Why it's wrong here
This definition is inaccurate for a Business Impact Analysis (BIA). A BIA is an analytical process designed to identify critical business functions and assess the potential impact of their disruption, leading to the determination of recovery requirements. The statement 'the maximum time to recover a business process' describes a time-based recovery metric, such as a Recovery Time Objective (RTO) or Maximum Tolerable Downtime (MTD), not the comprehensive analytical process of a BIA.
Go deeper
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.