SSCP Incident Response and Recovery Practice Question
An organization is conducting a disaster recovery test for its critical database. The RTO is 4 hours, and the RPO is 15 minutes. During the test, the team restores the database from a backup taken 2 hours before the test. The restore completes in 3 hours. Which statement accurately reflects the test outcome?
⚠ Common exam trap
The trap here is focusing only on the RTO and ignoring the RPO, or confusing the two metrics, when both must be satisfied for a successful disaster recovery test.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The test failed because the RPO was exceeded.
The RPO defines the maximum tolerable data loss, measured in time. A 2-hour-old backup means up to 2 hours of data could be lost, which exceeds the 15-minute RPO. The RTO, which is the maximum tolerable downtime, was met because the restore took 3 hours out of 4 allowed. However, since the RPO was violated, the test failed overall. The correct statement identifies the RPO exceedance as the failure reason.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The test failed because the restore took longer than 15 minutes.
Why it's wrong here
The 15-minute figure is the RPO, not the RTO. The RTO is 4 hours, and the restore took 3 hours, which is within the RTO. The failure is due to RPO violation, not restore time. This statement confuses RTO and RPO, making it incorrect.
- ✗
The test passed because the backup was available and restorable.
Why it's wrong here
While the backup was restorable, the test's success is measured against both RTO and RPO. The RPO was violated, so the test cannot be considered a full pass. Availability of a backup is necessary but not sufficient. This statement overlooks the RPO requirement, making it incorrect.
- ✗
The test passed because the RTO was met.
Why it's wrong here
The RTO is 4 hours, and the restore completed in 3 hours, so the RTO was met. However, the RPO was not met because the backup was 2 hours old, exceeding the 15-minute RPO. Meeting the RTO alone does not mean the test passed; both RTO and RPO must be satisfied. Therefore, this statement is incorrect.
- ✓
The test failed because the RPO was exceeded.
Why this is correct
The RPO is 15 minutes, meaning the organization can tolerate losing at most 15 minutes of data. The backup used was 2 hours old, so up to 2 hours of data would be lost, exceeding the RPO. Even though the restore time was within the RTO, the data loss exceeds the RPO, so the test failed from a data loss perspective. This makes the statement correct.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.