How to Calculate RTO and RPO from Maximum Acceptable Downtime and Data Loss?
A company is developing a DR plan for a critical database. The maximum acceptable downtime is 2 hours, and the maximum data loss is 1 hour. What are the RTO and RPO?
Quick Answer
RTO is 2 hours and RPO is 1 hour because these two metrics map directly onto the two constraints given in the scenario, and recognizing which constraint belongs to which metric is the whole exercise. Recovery Time Objective answers the question of how long the system can be down before the outage itself becomes unacceptable; it's a measure of downtime tolerance, and the scenario states that maximum acceptable downtime is 2 hours, so that figure is the RTO by definition. Recovery Point Objective answers a different question: how much data can be afforded to lose, measured as a span of time since the last good backup or replication point; it's not about how long systems are down, but about how far back in time the restored data will be relative to the moment of failure. The scenario's maximum acceptable data loss of 1 hour maps directly onto RPO. These two metrics drive very different technical decisions: RTO shapes how fast your recovery process and failover mechanisms need to be, while RPO shapes how frequently you need to back up or replicate data, since a 1-hour RPO requires backups or replication running at least that often. Whenever a question gives you a downtime tolerance and a data-loss tolerance separately, match downtime to RTO and data loss to RPO; they are never interchangeable, even though both are expressed in units of time.
⚠ Common exam trap
It's easy for candidates to confuse RTO (time to recover) with RPO (data loss tolerance), leading candidates to swap the two values or assume they must be equal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RTO = 2 hours, RPO = 1 hour
The Recovery Time Objective (RTO) is the maximum acceptable downtime, which is 2 hours. The Recovery Point Objective (RPO) is the maximum acceptable data loss, which is 1 hour. Therefore, option A correctly identifies RTO = 2 hours and RPO = 1 hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RTO = 2 hours, RPO = 1 hour
Why this is correct
RTO defines the maximum tolerable downtime, so 2 hours maps directly to RTO. RPO defines the maximum tolerable data loss measured in time, so 1 hour maps to RPO. The option matches both stated constraints exactly.
- ✗
RTO = 1 hour, RPO = 1 hour
Why it's wrong here
RTO is the maximum acceptable downtime, stated as 2 hours, not 1. RPO is the maximum tolerable data loss, correctly 1 hour. Setting RTO to 1 hour tightens the recovery target beyond the business requirement, which raises cost without addressing the stated 2-hour tolerance.
- ✗
RTO = 1 hour, RPO = 2 hours
Why it's wrong here
RPO is the maximum tolerable data loss, given as 1 hour, not 2. RTO is the maximum acceptable downtime, correctly 2 hours here. Swapping them misstates the recovery point objective, implying the business can lose twice the data it actually permits.
- ✗
RTO = 2 hours, RPO = 2 hours
Why it's wrong here
RPO of 2 hours exceeds the stated maximum tolerable data loss of 1 hour, so a two-hour backup interval would breach the requirement. It is tempting because RTO and RPO are easily confused, and matching both values to the downtime figure looks tidy; RPO measures data loss, not recovery time.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After a ransomware incident, an organization decides to restore data from backups. The RPO (Recovery Point Objective) is 4 hours. What does this RPO indicate?
medium- ✓ A.Backups must be taken at least every 4 hours to ensure data loss does not exceed 4 hours
- B.The organization can tolerate 4 hours of downtime
- C.The system must be restored within 4 hours of the incident
- D.The recovery process will take a maximum of 4 hours
Why A: The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must be taken at least every 4 hours to ensure that in the worst case, no more than 4 hours of data is lost. This directly dictates the backup frequency, not the recovery time or downtime.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.