SSCP Incident Response and Recovery Practice Question
A security analyst is reviewing a disaster recovery plan and notes that the organization has a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours for a critical database. Which of the following backup strategies BEST meets these objectives?
⚠ Common exam trap
The trap here is assuming that hourly backups meet a 15-minute RPO or that a warm site can recover within 2 hours.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Continuous data protection (CDP) with asynchronous replication to a hot site.
The RPO of 15 minutes requires that no more than 15 minutes of data can be lost, necessitating continuous or near-continuous backup. The RTO of 2 hours demands rapid recovery, which a hot site with asynchronous replication can provide. Continuous data protection combined with a hot site meets both objectives by minimizing data loss and downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Continuous data protection (CDP) with asynchronous replication to a hot site.
Why this is correct
CDP captures every change and can provide an RPO of near zero, easily meeting the 15-minute requirement. Asynchronous replication to a hot site allows for rapid recovery, often within minutes, satisfying the 2-hour RTO. This combination ensures minimal data loss and quick restoration, aligning with the critical database's needs.
- ✗
Hourly incremental backups to a local NAS with nightly replication to a warm site.
Why it's wrong here
Hourly incremental backups result in up to 60 minutes of data loss, which exceeds the 15-minute RPO. While replication to a warm site may aid recovery, the warm site typically requires more time to become operational, potentially exceeding the 2-hour RTO. This strategy is insufficient for the specified objectives.
- ✗
Daily full backups with weekly tape rotation stored offsite.
Why it's wrong here
Daily full backups would result in up to 24 hours of data loss, which exceeds the 15-minute RPO. Additionally, restoring from tape can easily take longer than 2 hours, violating the RTO. This strategy is cost-effective but does not meet the stringent requirements of the scenario.
- ✗
Weekly full backups with daily differential backups stored in the cloud.
Why it's wrong here
Weekly full and daily differential backups can result in up to 24 hours of data loss, far exceeding the 15-minute RPO. Cloud storage may facilitate recovery, but restoring large volumes can take hours, likely violating the 2-hour RTO. This approach is not suitable for a critical database with tight RPO and RTO.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.