CISSP Security Operations Practice Question
Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RPO
Recovery Point Objective (RPO) determines the acceptable data loss measured in time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RPO
Why this is correct
The Recovery Point Objective (RPO) specifies the maximum acceptable amount of data that an organization can afford to lose following a disruption. This metric is typically expressed as a time interval, such as 'data loss not exceeding the last four hours' or 'no more than one day's worth of transactions.' It directly influences the frequency of data backups, snapshots, or replication strategies required to meet this business continuity target.
- ✗
MTD
Why it's wrong here
Maximum Tolerable Downtime (MTD), also known as Maximum Tolerable Period of Disruption (MTPoD), represents the absolute longest period a business process or system can be unavailable without causing unacceptable damage to the organization. This comprehensive metric considers the total impact of an outage, including the time for recovery and any manual workarounds. It provides the upper limit for both RTO and the duration of any interim manual processes.
- ✗
MTTR
Why it's wrong here
Mean Time to Repair (MTTR) is an operational metric that quantifies the average time required to diagnose, repair, and restore a failed system or component to full operational status. It encompasses the time spent on fault detection, isolation, repair, and verification. MTTR is a key indicator of system maintainability and the efficiency of maintenance processes, but it does not define business objectives for data loss or system availability.
- ✗
RTO
Why it's wrong here
The Recovery Time Objective (RTO) defines the maximum acceptable duration of time from the point of an incident until the restoration of business operations to an acceptable service level. This objective dictates how quickly critical IT systems and applications must be brought back online and made available after a disaster or disruption. Unlike RPO, RTO focuses on the time taken to resume functionality, not the volume of data lost.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.