mediumMultiple Select
SSCP Practice Question: Which TWO of the following are essential…
Which TWO of the following are essential components of a disaster recovery plan (DRP)?
⚠ Common exam trap
SSCP often tests the confusion between DRP components and broader BCP elements, and candidates may incorrectly select BCP as a component of DRP rather than recognizing RTO and RPO as the core metrics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) is a correct answer because it defines the maximum acceptable downtime after a disruption, specifying how quickly systems and services must be restored, which is a core metric every DRP must establish to guide recovery priorities. The Recovery Point Objective (RPO) is also correct because it defines the maximum tolerable amount of data loss measured in time, determining the required backup frequency and replication strategy within the DRP. Together, RTO and RPO are essential, quantifiable components that shape the recovery strategies, resource allocation, and backup/replication design of a disaster recovery plan. The Business Continuity Plan (BCP) is not a component of a DRP but rather a broader, higher-level plan that encompasses and coordinates the DRP alongside other continuity activities. A RACI matrix for incident response belongs to incident management and role assignment, not to the essential recovery objectives of a DRP, and penetration test results are security assessment artifacts that may inform risk analysis but are not essential DRP components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recovery Time Objective (RTO)
Why this is correct
The Recovery Time Objective defines the maximum tolerable downtime for each critical system, driving recovery priorities and resource decisions. Without it, a DRP cannot specify how quickly services must be restored, making it an essential component.
- ✓
Recovery Point Objective (RPO)
Why this is correct
RPO defines the maximum tolerable data loss measured in time, directly shaping backup frequency and replication strategy. A DRP cannot specify recovery steps without this target, so it is an essential component alongside the recovery time objective.
- ✗
Business Continuity Plan (BCP)
Why it's wrong here
The BCP is the broader organisational framework covering all critical business functions; the DRP is the IT-focused subset that restores systems and data supporting it. It is tempting because the two are closely related, and it would be correct as the parent document when the question asks for business-wide continuity planning.
- ✗
A RACI matrix for incident response
Why it's wrong here
A RACI matrix assigns responsibility for incident handling, which sits in the incident response plan; a DRP centres on recovering IT services and data after disruption. It is tempting because clear ownership aids recovery, and it would be correct within an incident response plan rather than the DRP itself.
- ✗
Results of a penetration test
Why it's wrong here
Penetration test results measure exploitable vulnerabilities in systems; they do not document recovery procedures, roles or restoration priorities. It is tempting because testing validates preparedness, and it would be correct evidence for a security assessment or vulnerability management programme, not as a DRP component.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.