ISC2-CC - Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts - Section 2.2

Understand the purpose and components of disaster recovery, including recovery time objective (RTO) and recovery point objective (RPO).

Explain that disaster recovery (DR) restores IT systems and data after a disruptive event, governed by the recovery time objective (RTO, how quickly a system must be back) and recovery point objective (RPO, how much data loss is tolerable). Recognise the role of backups and alternate sites - hot, warm, and cold - in meeting these objectives.

Disaster recoveryRecovery time objectiveRecovery point objectiveBackup sites

Practice question for this objective

Free sampleBusiness Continuity (BC), Disaster Recovery (DR) & Incident Response Conceptsmedium

A trainee claims the recovery point objective and the recovery time objective mean the same thing. Which explanation most accurately distinguishes the recovery point objective?

  • AIt sets how quickly staff must be relocated to an alternate work site after an incident.
  • BIt defines the maximum tolerable age of recoverable data, indicating how much data loss is acceptable. Correct
  • CIt states the longest period a function may remain down before the organisation fails entirely.
  • DIt records the number of staff required to run a function at its minimum acceptable service level.
The recovery point objective defines the maximum acceptable age of recoverable data, meaning tolerable data loss. The recovery point objective anchors to the last usable data copy and so bounds how much recent data an organisation can lose, which is a data-currency measure separate from restoration speed.

Why A is wrong: Staff relocation timing is an operational recovery detail, not the recovery point objective. It is tempting because it sounds time-based, but the recovery point objective concerns data, not people.

Why B is correct: This is correct because the recovery point objective marks the point in time to which data must be recoverable, so it expresses the acceptable amount of data loss, unlike the time-focused recovery time objective.

Why C is wrong: This describes the maximum tolerable downtime, a different measure. It is tempting because it is a time limit, but it governs outage length rather than data currency.

Why D is wrong: Minimum staffing is a resource requirement, not a timing objective. It is tempting because the analysis captures resource needs, but the recovery point objective is strictly about data loss over time.

See more ISC2-CC practice questions with worked answers.

More in this domain

Back to all Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts objectives, or the ISC2-CC cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.