Examkin

Question

Difficulty: MediumBusiness Impact Analysis and Business Continuity Management

An enterprise risk management team is conducting a Business Impact Analysis (BIA) to update the business continuity plan for a core online payment platform. During the assessment, the team reviews operational recovery metrics and system availability controls. Which of the following statements correctly align BIA metrics and continuity parameters with their operational objectives? (Select TWO.)

  1. Establishing a Recovery Point Objective (RPO) of 15 minutes specifies the maximum allowable duration of transaction data loss during an unexpected outage.Answer
  2. Defining a Recovery Time Objective (RTO) of 2 hours sets the targeted timeframe within which the application and underlying infrastructure must be restored to service.Answer
  3. C
    Setting a Maximum Tolerable Downtime (MTD) value lower than the Recovery Time Objective (RTO) guarantees that systems recover before catastrophic financial loss occurs.
  4. D
    Deploying an active-active geographically redundant hot site functions primarily as a detective control to notify analysts of primary data center failure.

Answer

The two correct statements are: establishing an RPO of 15 minutes specifies the maximum allowable data loss duration, and defining an RTO of 2 hours sets the targeted timeframe within which the application must be restored.
The statement specifying RPO as the allowable duration of transaction data loss correctly describes the metric's purpose of quantifying data currency loss boundaries. The statement defining RTO as the targeted timeframe for service restoration correctly identifies the system downtime operational objective.

Step-by-Step Solution

1
Analyze the definitions of Recovery Point Objective (RPO) and Recovery Time Objective (RTO) in BIA contexts.
RPO measures acceptable data loss timeframe prior to an outage, while RTO measures acceptable downtime to restore service operational status.
Clear differentiation between data loss thresholds (RPO) and system restoration duration (RTO) is essential for correct BIA metrics application.
2
Evaluate the relationship between Maximum Tolerable Downtime (MTD) and Recovery Time Objective (RTO).
RTO must be less than or equal to MTD to ensure systems are restored before exceeding the organization's maximum tolerance for downtime.
If RTO exceeds MTD, the organization will suffer irreversible damage before systems are back online.
3
Classify the security control type of a redundant hot site.
Hot sites provide high availability and failover resilience, making them corrective/compensating availability controls rather than detective monitoring controls.
Detective controls identify incidents, whereas redundancy mechanisms mitigate and recover from failures.

Key Concept

Business Impact Analysis and Business Continuity Metrics (RTO, RPO, MTD)
Rate this question

Topics

Business Impact Analysis and Business Continuity Management

More questions from this topic