CISSP Practice Question: Which TWO of the following are essential…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Recovery Point Objective (RPO)

  Why this is correct

  The Recovery Point Objective (RPO) is a critical metric in disaster recovery planning, defining the maximum tolerable period in which data might be lost from an IT service due to a major incident. It quantifies the acceptable amount of data loss, typically measured in time (e.g., 1 hour, 24 hours), and directly influences backup frequency and data replication strategies. A well-defined RPO ensures that data recovery efforts align with business tolerance for data loss.

• ✗

  Business continuity plan

  Why it's wrong here

  While closely related and often integrated, a Business Continuity Plan (BCP) is a broader strategic document focused on maintaining essential business functions during and after a disruption, encompassing non-IT aspects like personnel, facilities, and supply chains. A Disaster Recovery Plan (DRP) is a specific component of the BCP, detailing the technical steps required to restore IT systems and data, making the BCP itself not an essential component of the DRP but rather its overarching framework.

• ✓

  Recovery Time Objective (RTO)

  Why this is correct

  The Recovery Time Objective (RTO) is an essential metric in disaster recovery, specifying the maximum acceptable duration of time that an application, system, or service can be unavailable after a disruption before unacceptable consequences occur. It dictates the speed at which systems must be restored and directly influences the choice of recovery strategies, such as hot, warm, or cold sites, to meet business operational requirements. A clear RTO is fundamental for prioritizing recovery efforts and allocating resources effectively.

• ✗

  Service Level Agreement (SLA)

  Why it's wrong here

  A Service Level Agreement (SLA) is a contractual agreement between a service provider and a customer, outlining the expected level of service, including uptime, performance, and support. While DRPs aim to help an organization meet its internal RTO/RPO commitments, which might be reflected in an SLA, the SLA itself is an external agreement and not an internal, operational component or objective of the disaster recovery plan itself. It defines expectations, rather than being a procedural or objective element of the recovery process.

• ✗

  Cold site configuration

  Why it's wrong here

  A cold site configuration refers to a type of alternate recovery facility that provides basic infrastructure like space, power, and cooling, but lacks pre-installed hardware, software, or data. While a cold site can be a strategy or resource utilized within a Disaster Recovery Plan to achieve RTO/RPO objectives, it is not an essential component or objective of the plan itself, unlike RPO and RTO which are fundamental metrics guiding the entire recovery strategy.

Go deeper

Related to this question