Question

Difficulty: MediumBusiness Impact Analysis and Business Continuity Management

A security analyst is conducting a Business Impact Analysis (BIA) for a hospital system's critical Single Sign-On (SSO) and Patient Identity service. The assessment establishes that the system can tolerate a maximum data loss window of 15 minutes for active user session state logs, but the authentication service itself must be restored to full operation within 2 hours of an outage to prevent severe clinical delays. Which of the following statements correctly align these parameters with Business Continuity Management (BCM) metrics? (Select TWO.)

  1. The maximum acceptable data loss timeframe of 15 minutes defines the Recovery Point Objective (RPO).Answer
  2. The target restoration timeframe of 2 hours for service functionality defines the Recovery Time Objective (RTO).Answer
  3. C
    The 2-hour target restoration duration represents the Recovery Point Objective (RPO) for system availability.
  4. D
    Deploying redundant SSO servers in an active-active load balanced cluster is classified as a corrective security control.

Answer

The maximum acceptable data loss timeframe of 15 minutes defines the Recovery Point Objective (RPO), and the target restoration timeframe of 2 hours for service functionality defines the Recovery Time Objective (RTO).
Recovery Point Objective (RPO) defines the maximum tolerable data loss window (15 minutes in this scenario), representing how far back data recovery must go. Recovery Time Objective (RTO) defines the targeted timeframe to restore business operations or systems following an outage (2 hours in this scenario). Both statements accurately map the BIA metrics to the organizational parameters.

Step-by-Step Solution

1
Identify the data loss boundary in the scenario.
The scenario allows a maximum data loss window of 15 minutes for session state logs.
Recovery Point Objective (RPO) dictates the maximum tolerable data loss measured back in time from the moment of disruption.
2
Identify the service recovery duration in the scenario.
The scenario requires the authentication service to be restored to operation within 2 hours.
Recovery Time Objective (RTO) specifies the maximum acceptable duration of system downtime required to bring operations back online.
3
Evaluate the metric definitions against the options.
Assigning 15 minutes to RPO and 2 hours to RTO correctly applies BCM taxonomy.
RPO focuses on data persistence and backups, whereas RTO focuses on operational downtime and service restoration.

Key Concept

Distinction between Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
Estimated Time:1m 30s
Rate this question