CISSP Security Operations Practice Question
Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RPO
RPO defines the acceptable data loss in terms of time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MTTR
Why it's wrong here
MTTR, or Mean Time To Repair, measures the average time required to repair a failed system or component and restore it to full operational status. While crucial for assessing system maintainability and the efficiency of recovery processes, it does not quantify the maximum acceptable amount of data loss. Therefore, MTTR is unrelated to determining how much data an organization can afford to lose in a disaster.
- ✓
RPO
Why this is correct
RPO, or Recovery Point Objective, precisely defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate following a disruptive event. It dictates the age of files or data that must be recovered from backup storage for normal operations to resume. Establishing the RPO is critical for determining backup frequency and data replication strategies to ensure business continuity.
- ✗
RTO
Why it's wrong here
RTO, or Recovery Time Objective, specifies the maximum acceptable duration of time that an application, system, or process can be unavailable after a disaster before causing unacceptable damage to the business. It focuses on the speed of restoration and the time taken to bring systems back online. RTO is distinct from data loss, as it addresses the acceptable downtime rather than the quantity of lost data.
- ✗
MTD
Why it's wrong here
MTD, or Maximum Tolerable Downtime (also known as Maximum Tolerable Period of Disruption), represents the absolute longest period a business process can be inoperative without causing irreparable harm to the organization. This metric encompasses both the RTO and any additional time for manual workarounds or degraded operations. MTD is a broader business-level tolerance for disruption, not a direct measure of acceptable data loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.