I85PREP
⌘ K
CCRTS study materials
CCRTS study resources

CCRTS practice questions

One question at a time. Build your CCRTS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Resilience Strategy, Governance, and Risk

In cyber resilience strategy, what distinguishes resilience from pure security controls?

  1. Resilience is measured exclusively by the number of vulnerabilities remediated per quarter
  2. Resilience focuses on the ability to anticipate, withstand, recover from, and adapt to adverse conditions, not only on preventing intrusion Correct answer.
  3. Resilience replaces the need for preventive controls by relying solely on insurance transfer
  4. Resilience is limited to meeting statutory breach-notification timelines after an incident

Explanation

Resilience engineering assumes some adverse events will succeed and therefore emphasizes continuity, recovery, and adaptation alongside prevention. Security controls are a subset of the wider resilience capability, which also covers response, restoration, and organizational learning. Frameworks such as NIST SP 800-160 Vol. 2 describe resilience as spanning anticipate, withstand, recover, and adapt.

Question 2Cyber Resilience Strategy, Governance, and Risk

A board asks why the organization should adopt a formal cyber risk appetite statement rather than approving each security project individually. What is the primary governance value of a risk appetite statement?

  1. It fixes the annual security budget at a level the board cannot later reduce
  2. It assigns personal legal liability for breaches to the Chief Information Security Officer
  3. It guarantees that no cyber incident can exceed the organization's insurance coverage limits
  4. It documents the maximum tolerable loss and risk levels that guide decentralized decisions without escalating every case Correct answer.

Explanation

A risk appetite statement expresses how much risk the organization is willing to accept in pursuit of its objectives, enabling consistent decisions at lower levels. It is a decision-enablement tool, not a guarantee, liability assignment, or budget lock. Effective statements include qualitative tolerances and often quantitative thresholds such as maximum tolerable downtime.

Question 3Cyber Resilience Strategy, Governance, and Risk

Which set of functions forms the core of the NIST Cybersecurity Framework 2.0?

  1. Assess, Certify, Accredit, and Audit
  2. Identify, Protect, Detect, Respond, Recover, and Govern Correct answer.
  3. Plan, Build, Run, and Retire
  4. Prevent, Insure, Transfer, and Accept

Explanation

NIST CSF 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in version 2.0 to elevate cybersecurity risk management to the organizational level. The other option sets describe lifecycle or assurance processes, not the CSF structure.

Question 4Cyber Resilience Strategy, Governance, and Risk

An organization classifies a payroll system as critical after a business impact analysis. Which finding most directly justifies that classification?

  1. The system runs on an operating system nearing end of vendor support
  2. A 24-hour outage would halt salary payments and trigger regulatory and workforce consequences Correct answer.
  3. A recent scan found unpatched medium-severity libraries on the host
  4. The system's administrator has not completed role-based training this year

Explanation

Criticality classification in a BIA rests on the business consequences of loss of the function, such as financial, regulatory, and operational impact. Technical weaknesses are risk factors that inform treatment but do not by themselves define business criticality. End-of-support status and training gaps affect likelihood and exposure, not impact tolerance.

Question 5Cyber Resilience Strategy, Governance, and Risk

Under a typical cyber insurance policy, which element most often limits recovery of losses caused by a widely publicized supply-chain compromise affecting many policyholders simultaneously?

  1. The obligation to maintain a documented incident response plan
  2. An aggregate limit combined with a war or systemic-event exclusion Correct answer.
  3. The use of multi-factor authentication for remote access
  4. The requirement to notify regulators within 72 hours of discovery

Explanation

Insurers manage correlated catastrophe exposure through aggregate limits and exclusions for systemic or widespread events, including some state-sponsored attacks. Notification timelines and control requirements are conditions of coverage but do not cap recovery in the same structural way. MFA is an underwriting consideration, not a loss-limiting clause.

Question 6Cyber Resilience Strategy, Governance, and Risk

In risk treatment terminology aligned with ISO 31000, which option is a valid treatment for a risk that exceeds appetite?

  1. Average the risk score with lower-scoring assets to reduce the portfolio mean
  2. Modify the risk by applying a compensating control and reassessing residual exposure Correct answer.
  3. Reclassify the asset as non-critical to remove it from scope
  4. Record the risk in the register without any owner or review date

Explanation

ISO 31000 treatment options include avoiding, reducing (modifying), sharing, and retaining risk, each followed by reassessment of residual risk. Leaving a risk unowned or manipulating classifications does not change underlying exposure. Averaging scores obscures rather than treats individual risks.

Question 7Cyber Resilience Strategy, Governance, and Risk

A resilience strategy calls for a recovery time objective of two hours for a customer portal, but the tested restore from backup takes nine hours. What is the most appropriate governance response?

  1. Remove the portal from the recovery plan because it cannot meet the target
  2. Publish the two-hour RTO in the service catalog and retest next year
  3. Extend the backup retention period from 30 to 90 days
  4. Document the gap and fund changes such as warm standby or replication, or formally accept a revised RTO Correct answer.

Explanation

Test results that contradict stated recovery objectives create a documented gap between required and achievable capability. Governance requires either investing to close the gap or formally accepting a revised objective with the business owner. Reporting an unachievable target or deleting the service from the plan misrepresents resilience.

Question 8Cyber Resilience Strategy, Governance, and Risk

Which metric best expresses the maximum tolerable period of disruption for a business process during a resilience review?

  1. Mean time between failures for the servers supporting the process
  2. Mean time to detect anomalies in the process's transaction logs
  3. Maximum tolerable downtime derived from the point at which unacceptable harm begins Correct answer.
  4. Number of recovery exercises completed in the last twelve months

Explanation

Maximum tolerable downtime is the threshold beyond which the impact of disruption becomes unacceptable to the organization. MTBF, detection time, and exercise counts are operational metrics that inform capability but do not define impact tolerance. RTO should be set at or below the maximum tolerable downtime.

Question 9Cyber Resilience Strategy, Governance, and Risk

A regulator requires the firm to demonstrate senior management accountability for cyber risk. Which arrangement best satisfies that expectation?

  1. Relying on the IT steering committee, which meets twice a year
  2. Assigning accountability to the security operations shift lead
  3. A board-level risk committee that receives cyber risk reporting and holds a named executive accountable Correct answer.
  4. Delegating all cyber decisions to the outsourced managed security service provider

Explanation

Regulatory accountability expectations, such as those in DORA and similar regimes, require clear senior management responsibility and board oversight of cyber risk. Accountability can be supported by a named executive owner and regular board-level reporting. Outsourcing execution to a provider does not transfer accountability.

Question 10Cyber Resilience Strategy, Governance, and Risk

What is the primary purpose of a tabletop exercise in a cyber resilience program?

  1. To validate that endpoint agents are deployed on every workstation
  2. To confirm that firewall rules match the approved baseline
  3. To measure the throughput of the backup appliance under load
  4. To rehearse decision-making, communication, and escalation among stakeholders against a plausible scenario Correct answer.

Explanation

Tabletop exercises test coordination, judgment, and communication among executives and responders without live systems. Technical validation of agents, backup throughput, and firewall baselines belongs to control testing and technical drills. A tabletop surfaces gaps in roles, playbooks, and external coordination.

Question 11Cyber Resilience Strategy, Governance, and Risk

An organization wants to reduce the likelihood of a single ransomware event halting all regional operations. Which strategy most directly addresses that resilience objective?

  1. Segmented networks with isolated, tested backups and a documented manual fallback procedure Correct answer.
  2. Requiring annual security awareness training for all staff
  3. Increasing the cyber insurance limit to cover full revenue loss
  4. Consolidating all backups on the same domain-joined storage array as production data

Explanation

Resilience against widespread ransomware depends on limiting lateral movement and ensuring recovery is possible from isolated, verified backups with manual fallback. Co-locating backups with production exposes them to the same attack. Insurance and awareness training reduce financial and human risk but do not preserve operational continuity.

Question 12Cyber Resilience Strategy, Governance, and Risk

Which statement correctly describes the relationship between a risk register and a control catalog?

  1. The control catalog records accepted risks, and the risk register lists implemented technologies
  2. The risk register and control catalog are the same artifact maintained by the audit function
  3. The risk register records identified risks with owners and treatment status, while the control catalog lists reusable safeguards mapped to risks Correct answer.
  4. The risk register is used only for project risks, and the control catalog only for IT operations

Explanation

A risk register is the authoritative log of risks, their assessment, owners, and treatment decisions. A control catalog is a library of safeguards that can be selected and mapped to risks and framework requirements. They are complementary artifacts with different purposes and owners.

Question 13Cyber Resilience Strategy, Governance, and Risk

A third-party processor suffers a breach that exposes the organization's customer data. Under a shared-responsibility model, what is the organization's most defensible governance action?

  1. Invoke contractual notification and audit rights and assess its own residual liability and disclosure duties Correct answer.
  2. Rely on the processor's ISO 27001 certificate as proof that no notification is required
  3. Suspend all cloud services immediately to demonstrate diligence
  4. Assume the processor will handle all regulatory notifications on the organization's behalf without confirmation

Explanation

Outsourcing processing does not transfer the controller's regulatory and contractual obligations. The organization must exercise contract rights, verify facts, and meet its own notification and disclosure duties. Certifications indicate a management system exists but do not prove absence of breach or eliminate notification obligations.

Question 14Cyber Resilience Strategy, Governance, and Risk

Which practice best supports defensible deletion of sensitive data as part of a data governance program?

  1. Relying on users to delete their own files when they leave the organization
  2. Applying retention schedules with verified disposal and documented evidence of destruction Correct answer.
  3. Retaining all data indefinitely in case it is needed for future analytics
  4. Deleting data only when storage capacity thresholds are reached

Explanation

Defensible deletion requires documented retention schedules, verified destruction methods, and evidence that disposal occurred. Indefinite retention increases exposure and legal discovery burden. Ad hoc or capacity-driven deletion lacks consistency and auditability.

Question 15Cyber Resilience Strategy, Governance, and Risk

A risk assessment identifies a vulnerability with high likelihood but low impact, and another with low likelihood but catastrophic impact. Both exceed appetite. Which approach reflects sound prioritization?

  1. Treat both, weighting the catastrophic scenario for continuity planning while applying efficient controls to the high-frequency issue Correct answer.
  2. Treat only the high-likelihood risk because frequency dominates expected loss
  3. Ignore the low-likelihood risk because catastrophic events are rare by definition
  4. Average the two scores and treat them as a single combined risk

Explanation

Risk prioritization considers both expected loss and tail consequences, and catastrophic low-probability events warrant continuity and recovery investment even when expected value is modest. Dismissing rare events ignores ruin potential. Averaging distinct risks destroys the information needed for treatment decisions.

Question 16Cyber Resilience Strategy, Governance, and Risk

In a governance model, what is the function of a three-lines model for cyber risk?

  1. The first line writes policy, the second line operates controls, and the third line approves budgets
  2. Operating management owns risk, an independent risk function provides oversight, and internal audit gives independent assurance Correct answer.
  3. The model assigns external auditors to run incident response during major events
  4. All three lines report to the security operations manager to ensure unity of command

Explanation

The three-lines model separates risk ownership in the business, independent oversight and challenge, and independent assurance by audit. This separation prevents the same group from owning and assuring its own controls. External auditors and regulators sit outside the three lines.

Question 17Cyber Resilience Strategy, Governance, and Risk

An organization must choose between a hot site and a cold site for a trading platform with a two-hour RTO. Which reasoning is most sound?

  1. Either option meets the RTO because both are alternate sites
  2. A cold site is preferable because it costs less and cost always dominates recovery design
  3. A hot site is unnecessary because backups alone satisfy any recovery objective
  4. A hot site supports the RTO because systems are pre-provisioned, whereas a cold site's provisioning delay would likely breach it Correct answer.

Explanation

Recovery site strategy must be matched to the RTO: hot sites provide near-immediate capability, while cold sites require infrastructure build-out that typically takes days. Cost matters but cannot override an impact-driven RTO without formal risk acceptance. Backups restore data but do not provide processing capacity.

Question 18Cyber Resilience Strategy, Governance, and Risk

Which indicator is a leading measure of cyber resilience maturity rather than a lagging outcome?

  1. Count of customer complaints related to outages
  2. Number of confirmed data breaches in the last fiscal year
  3. Percentage of critical services with tested and validated recovery procedures in the past year Correct answer.
  4. Total regulatory fines paid to date

Explanation

Leading indicators measure the strength of capabilities before an incident, such as tested recovery procedures. Breach counts, fines, and complaints are lagging outcomes that reflect events already realized. Maturity programs balance both types but use leading measures to drive improvement.

Question 19Cyber Resilience Strategy, Governance, and Risk

What does the term residual risk mean in a cyber risk management program?

  1. The risk remaining after controls and treatments have been applied Correct answer.
  2. The risk that existed before any controls were considered
  3. The portion of risk transferred to an insurer under a policy
  4. The risk associated with residual data left on decommissioned media

Explanation

Residual risk is what remains after treatment and must be compared against risk appetite before acceptance. Inherent risk is the pre-control exposure, and transferred risk is a treatment outcome rather than a residual category. Media sanitization is a separate operational concern.

Question 20Cyber Resilience Strategy, Governance, and Risk

A new regulation requires financial entities to test operational resilience against severe but plausible scenarios, including those involving third-party providers. Which program element most directly responds to this requirement?

  1. A monthly patch compliance dashboard for servers
  2. An annual phishing simulation campaign for all employees
  3. A quarterly review of firewall rule change tickets
  4. Threat-led penetration testing and scenario-based exercises that include critical third-party dependencies Correct answer.

Explanation

Severe-but-plausible scenario testing, such as threat-led penetration testing under frameworks like TIBER-EU and DORA requirements, exercises both the entity and its critical providers. Phishing simulations, change reviews, and patch dashboards are valuable hygiene controls but do not test resilience against severe scenarios.

Question 21Cyber Resilience Strategy, Governance, and Risk

Which element is essential for a cyber risk register entry to be actionable by governance bodies?

  1. A named risk owner, an assessed rating, and a treatment decision with a due date Correct answer.
  2. A copy of the vendor's marketing materials for the recommended product
  3. A list of every vulnerability scanner finding related to the asset
  4. An estimate of the attacker's skill level drawn from public reporting

Explanation

Actionable risk entries identify who owns the risk, how it is rated, and what treatment is planned with a timeline for completion. Raw scanner output and vendor materials are supporting data, not governance decisions. Speculation about attacker skill does not substitute for an assessed rating.

Question 22Cyber Resilience Strategy, Governance, and Risk

An organization's policy states that all critical vendors must be reassessed annually, but a critical payment processor has not been reviewed in three years. Which governance failure does this most directly illustrate?

  1. An error in the asset criticality classification
  2. A failure of the backup restoration process
  3. A gap between stated policy and operating effectiveness of the third-party risk process Correct answer.
  4. An inappropriate risk appetite set by the board

Explanation

The policy exists, but the control is not operating as designed, which is a classic effectiveness gap between intent and execution. Risk appetite, backup restoration, and asset classification are separate concerns that this fact pattern does not implicate. Governance must monitor control operation, not just policy existence.

Question 23Cyber Resilience Strategy, Governance, and Risk

Which capability most improves an organization's ability to adapt after a disruptive cyber event, as described in resilience engineering literature?

  1. Increasing the number of preventive controls without reviewing their effectiveness
  2. Capturing lessons learned and updating plans, training, and architecture based on incident findings Correct answer.
  3. Restoring the original configuration exactly as it was before the event
  4. Reducing documentation to speed future decision-making

Explanation

The adapt function of resilience involves learning from events and adjusting plans, training, and architecture accordingly. Restoring the prior state without change forgoes improvement, and adding controls without evaluation may not address the observed failure. Reducing documentation impairs coordination rather than improving adaptation.

Question 24Cyber Resilience Strategy, Governance, and Risk

What is the principal governance purpose of mapping controls to multiple frameworks such as NIST CSF, ISO 27001, and DORA requirements?

  1. To reuse evidence across obligations and identify gaps without duplicating control implementation Correct answer.
  2. To reduce the number of controls to those common to all frameworks
  3. To replace the risk assessment process with a compliance checklist
  4. To prove that certification to one framework satisfies every legal obligation automatically

Explanation

Control mapping lets one implemented control and its evidence satisfy several obligations, reducing duplicate effort and revealing gaps. Certification does not automatically satisfy legal duties, and mapping does not substitute for risk assessment. Intersecting frameworks would drop controls unique to some obligations.

Question 25Cyber Resilience Strategy, Governance, and Risk

A business unit wants to accept a risk that exceeds the enterprise appetite threshold. What is the correct governance path?

  1. Transfer the risk to the insurer and consider the matter closed
  2. Escalate to the accountable executive or risk committee for a documented, time-bound exception decision Correct answer.
  3. Lower the risk rating so it falls within the existing threshold
  4. Allow the business unit manager to accept it silently within their own budget

Explanation

Acceptance of risk above appetite requires escalation to the authority that owns the appetite, with a documented exception and review date. Silent local acceptance bypasses governance, and insurance transfer does not address the underlying exposure. Adjusting the rating to fit the threshold is a manipulation of the assessment.

Question 26Cyber Resilience Strategy, Governance, and Risk

Under the NIST Cybersecurity Framework 2.0, the GOVERN function addresses organizational context, risk management strategy, roles and responsibilities, policy, and oversight. Which activity is a GOVERN-function activity rather than an IDENTIFY-function activity?

  1. Inventorying hardware assets and mapping their network locations and owners
  2. Documenting data flows between internal systems and external partners
  3. Conducting vulnerability scans and recording the findings for remediation tracking
  4. Establishing the enterprise cyber risk appetite and tolerance statements that business units must operate within Correct answer.

Explanation

In CSF 2.0 the GOVERN function covers the organizational context in which cyber risk decisions are made, including risk appetite, tolerance, roles, policy, and supply-chain oversight. Asset inventory, vulnerability scanning, and data-flow mapping generate situational awareness and sit under IDENTIFY. Risk appetite is a decision-rights artifact, so it belongs to governance.

Question 27Cyber Resilience Strategy, Governance, and Risk

A board risk committee wants assurance that cyber risk reporting is independent of the teams that operate the controls. Which arrangement most directly preserves that independence?

  1. The IT operations director includes cyber metrics in the monthly operations dashboard
  2. The internal audit function reports its independent assessment of cyber risk management to the committee Correct answer.
  3. The chief information security officer consolidates self-assessments from control owners into the board pack
  4. The security operations manager presents control status directly to the committee each quarter

Explanation

Independence in assurance means the party evaluating the controls is not the party operating or owning them. Internal audit provides objective assurance to the board, which is the third-line role in a three-lines model. Self-assessment consolidated by the CISO or control owners remains first- or second-line reporting and lacks that independence.

Question 28Cyber Resilience Strategy, Governance, and Risk

An organization classifies a dataset as requiring protection for seven years, but its retention schedule deletes the records after three years. Which governance defect does this represent?

  1. The retention period conflicts with the required protection period, so data may be destroyed while still needed Correct answer.
  2. The access review frequency is shorter than the retention schedule
  3. The data classification label is too low for the encryption standard applied
  4. The backup recovery point objective is set too aggressively for the dataset

Explanation

Retention and protection requirements must be reconciled so that records are kept for at least as long as they must be protected and are then disposed of defensibly. A three-year deletion against a seven-year protection requirement creates premature destruction and potential legal or evidentiary exposure. The other options describe mismatches in recovery, encryption, or review cadence that this scenario does not establish.

Question 29Cyber Resilience Strategy, Governance, and Risk

Which statement best describes how a cyber risk appetite statement differs from a risk tolerance statement?

  1. Appetite is a quantitative metric, while tolerance is always a qualitative narrative without thresholds
  2. Appetite applies only to third-party risk, while tolerance applies only to technology risk
  3. Appetite is set by the security team, while tolerance is set by external regulators for the whole sector
  4. Appetite defines the amount and type of risk the organization is willing to pursue to meet objectives, while tolerance sets the acceptable variation around that level for specific risk categories Correct answer.

Explanation

Risk appetite expresses the broad level and types of risk an organization is willing to accept in pursuit of its objectives. Tolerance translates that appetite into concrete acceptable ranges or thresholds for particular risk categories and processes. Appetite is set internally by leadership, not by regulators, and neither concept is limited to one risk type.

Question 30Cyber Resilience Strategy, Governance, and Risk

A multinational firm operates under GDPR, a sector regulator's incident rule requiring notification within 72 hours, and contractual breach clauses with customers requiring notice within 24 hours. Which approach best resolves the conflicting notification timelines in its incident response governance?

  1. Follow the 72-hour regulatory deadline as the baseline and notify customers only after the regulator has been informed
  2. Adopt the customer 24-hour clause for all incidents regardless of whether personal data or regulated services are affected
  3. Apply the shortest applicable deadline across all obligations and maintain a decision matrix mapping each obligation to its trigger, recipient, and timeframe Correct answer.
  4. Delegate notification decisions to the legal team at the time of each incident without pre-defined procedures

Explanation

Where multiple notification duties overlap, governance should harmonize them by driving to the most stringent applicable deadline and pre-mapping each obligation to its trigger, recipient, and timeframe. A decision matrix lets responders act consistently and demonstrate compliance to every authority and counterparty. Choosing one regime in isolation risks breaching the others.

Question 31Business Impact Analysis and Recovery Objectives (RTO/RPO)

In business impact analysis, which statement best distinguishes the recovery time objective (RTO) from the recovery point objective (RPO)?

  1. RTO defines the maximum tolerable downtime for a process, while RPO defines the maximum tolerable data loss measured in time. Correct answer.
  2. RTO applies only to IT infrastructure, while RPO applies only to manual business processes.
  3. RTO defines the maximum acceptable data loss, while RPO defines the maximum tolerable downtime for a process.
  4. RTO is set by the auditor, while RPO is set by the backup vendor.

Explanation

RTO is a time-to-restore target: how long a business function or system can remain unavailable before impact becomes unacceptable. RPO is a data-loss tolerance expressed as the point in time to which data must be recoverable. They are independent objectives and both should be derived from business impact, not vendor or auditor preference.

Question 32Business Impact Analysis and Recovery Objectives (RTO/RPO)

A business impact analysis has identified a maximum tolerable downtime of four hours for the order-entry process. Which recovery objective does this value most directly establish?

  1. The SLA credit level for the order-entry vendor.
  2. The RTO for the order-entry process. Correct answer.
  3. The RPO for the order-entry database.
  4. The MTBF for the order-entry servers.

Explanation

Maximum tolerable downtime is the business's limit on how long a process can be unavailable, which translates directly into the recovery time objective. The RPO would be derived from acceptable data loss, not downtime duration. MTBF and SLA credits are unrelated reliability and commercial metrics.

Question 33Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which input is most important when deriving an RPO for a financial transaction system?

  1. The physical distance between the primary and alternate data centers.
  2. The acceptable volume of transactions that can be lost before financial or regulatory harm occurs. Correct answer.
  3. The average time required to restore the application from backup.
  4. The number of servers hosting the application.

Explanation

RPO is driven by how much data loss the business can absorb, expressed in transaction volume or elapsed time. Geographic separation and restore duration influence resilience and RTO but not the data-loss tolerance itself. Server count is a capacity detail with no bearing on the objective.

Question 34Business Impact Analysis and Recovery Objectives (RTO/RPO)

What is the primary purpose of conducting a business impact analysis before setting recovery objectives?

  1. To select the disaster recovery vendor with the lowest price.
  2. To test whether backups can be restored successfully.
  3. To determine which functions are critical and quantify the consequences of their disruption over time. Correct answer.
  4. To inventory every configuration item in the data center.

Explanation

BIA identifies critical business functions and measures how impact grows as disruption lengthens, which is the evidence base for RTO and RPO. Configuration inventory, restore testing, and vendor selection are downstream or unrelated activities. Objectives set without BIA evidence risk being arbitrary.

Question 35Business Impact Analysis and Recovery Objectives (RTO/RPO)

An organization states that its customer portal must never lose more than 15 minutes of submitted data. Which recovery objective has been specified?

  1. An MTD of 15 minutes.
  2. An SLA of 15 minutes.
  3. An RPO of 15 minutes. Correct answer.
  4. An RTO of 15 minutes.

Explanation

The statement constrains data loss to 15 minutes, which is the definition of a recovery point objective. RTO would constrain how long the portal may be unavailable. MTD is the total tolerable outage before severe harm, and an SLA is a contractual service commitment.

Question 36Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which pair of objectives is most likely appropriate for a system whose data can be regenerated from source documents within one business day but whose users need access within two hours?

  1. RTO of 24 hours and RPO of 2 hours.
  2. RTO of 2 hours and RPO of 2 hours.
  3. RTO of 2 hours and RPO of 24 hours. Correct answer.
  4. RTO of 24 hours and RPO of 24 hours.

Explanation

Access must be restored within two hours, so the RTO is two hours. Because lost data can be regenerated from source documents within a day, up to roughly 24 hours of data loss is tolerable, making the RPO 24 hours. The two objectives need not be equal and should each reflect their own business constraint.

Question 37Business Impact Analysis and Recovery Objectives (RTO/RPO)

During a BIA workshop, a process owner claims the RTO for payroll must be one hour. What is the most appropriate analyst response?

  1. Challenge the figure by asking what harm occurs at two, four, and twenty-four hours of outage and validate the objective against that impact curve. Correct answer.
  2. Accept the figure because process owners always define objectives.
  3. Defer the decision to the backup software vendor's recommended settings.
  4. Set the RTO to the technical recovery capability of the backup system.

Explanation

RTOs should be justified by quantified impact over time rather than asserted as preferences. Probing impact at several outage durations reveals whether one hour is a genuine business threshold or an arbitrary wish. Technical capability and vendor defaults inform feasibility but must not define the business requirement.

Question 38Business Impact Analysis and Recovery Objectives (RTO/RPO)

A cost-benefit analysis shows that reducing the RTO of a claims system from 12 hours to 2 hours would cost $400,000 annually while avoiding an estimated $150,000 in losses. How should the analyst present this finding?

  1. Recommend the two-hour RTO because shorter recovery is always better.
  2. Recommend retaining a longer RTO and document that the incremental cost exceeds the quantified benefit. Correct answer.
  3. Reject any RTO longer than four hours as noncompliant.
  4. Remove the loss estimate so the shorter RTO appears justified.

Explanation

Recovery objectives should be economically justified; where the cost of tightening an objective exceeds the losses avoided, the business case does not support it. The analyst should document the comparison and recommend the defensible target. Shorter recovery is not automatically better when the marginal cost outweighs the benefit.

Question 39Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which metric expresses the longest period a business function can be unavailable before the organization suffers unacceptable consequences?

  1. Mean time to repair.
  2. Recovery point objective.
  3. Maximum tolerable downtime. Correct answer.
  4. Recovery time objective.

Explanation

Maximum tolerable downtime, also called maximum tolerable period of disruption, is the outer limit of outage the business can survive before unacceptable harm. The RTO is a stricter internal target set at or below that limit. RPO concerns data loss and MTTR concerns repair duration for components.

Question 40Business Impact Analysis and Recovery Objectives (RTO/RPO)

A BIA reveals that a warehouse scanning system supports operations that can run on paper for up to three days but that transaction data must not be lost beyond four hours. Which objectives reflect this analysis?

  1. RTO of three days and RPO of four hours. Correct answer.
  2. RTO of four hours and RPO of four hours.
  3. RTO of three days and RPO of three days.
  4. RTO of four hours and RPO of three days.

Explanation

The downtime tolerance of three days sets the RTO, while the four-hour data-loss tolerance sets the RPO. Manual workarounds extend the acceptable outage but do not extend acceptable data loss. Keeping the two objectives separate reflects the distinct business constraints.

Question 41Business Impact Analysis and Recovery Objectives (RTO/RPO)

Why should recovery objectives be reviewed at planned intervals after initial approval?

  1. Because RTO and RPO values expire automatically after twelve months.
  2. Because vendors release new backup products that reset the objectives.
  3. Because business processes, dependencies, and tolerable impact change over time, so objectives can become stale. Correct answer.
  4. Because regulatory frameworks require annual re-signing of the same figures.

Explanation

Objectives reflect current business impact, and impact shifts as processes, revenue models, and technology dependencies change. Periodic review keeps recovery targets aligned with reality. There is no automatic expiry, and vendor product cycles do not redefine business requirements.

Question 42Business Impact Analysis and Recovery Objectives (RTO/RPO)

A department reports that its RTO cannot be met with current infrastructure. What is the most appropriate next step in the BIA and recovery planning cycle?

  1. Perform a gap analysis, present the shortfall with risk exposure, and decide whether to invest, accept the risk, or redesign the process. Correct answer.
  2. Silently extend the RTO to match current capability.
  3. Delete the objective so the plan appears compliant.
  4. Transfer the objective to the facilities team.

Explanation

A gap between required and achievable recovery is a risk decision for management, informed by a documented gap analysis. Options include funding remediation, formally accepting the risk, or changing the process. Quietly relaxing the objective hides the exposure rather than managing it.

Question 43Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which statement about the relationship between RTO and maximum tolerable downtime is correct?

  1. The RTO is irrelevant once maximum tolerable downtime is documented.
  2. The RTO must always exceed the maximum tolerable downtime.
  3. The RTO should be equal to or shorter than the maximum tolerable downtime. Correct answer.
  4. The RTO and maximum tolerable downtime are the same metric.

Explanation

Maximum tolerable downtime is the outer boundary of acceptable outage, so the planned recovery target must fall within it to protect the business. Setting an RTO longer than the tolerable limit would guarantee unacceptable harm. The two are related but distinct, and both remain relevant to planning.

Question 44Business Impact Analysis and Recovery Objectives (RTO/RPO)

A BIA team is prioritizing processes. Which combination of factors best supports ranking a process as tier one?

  1. Long historical uptime and a recent hardware refresh.
  2. High revenue impact per hour of outage, regulatory reporting obligations, and numerous dependent processes. Correct answer.
  3. A large documentation library and frequent internal audits.
  4. Low customer visibility and a large number of part-time staff.

Explanation

Tiering reflects the consequences of disruption, so high financial impact per hour, legal or regulatory exposure, and downstream dependencies are strong indicators of criticality. Uptime history, staffing patterns, and documentation volume describe operational characteristics rather than impact. Prioritization should follow quantified business consequence.

Question 45Business Impact Analysis and Recovery Objectives (RTO/RPO)

An application's RPO is 30 minutes, but backups run nightly. What does this indicate?

  1. A recovery capability gap exists, since up to 24 hours of data could be lost against a 30-minute tolerance. Correct answer.
  2. The RPO is satisfied because nightly backups are a standard practice.
  3. The application requires no further data protection measures.
  4. The RTO is automatically 30 minutes as well.

Explanation

A nightly backup cadence permits up to roughly a day of data loss, far exceeding a 30-minute RPO. The mismatch is a capability gap that calls for more frequent replication, log shipping, or continuous protection. Backup frequency must be aligned to the stated data-loss tolerance.

Question 46Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which technique is most appropriate for validating that a documented RTO is achievable in practice?

  1. Comparing the RTO to the RPO.
  2. Reviewing the plan document with senior management.
  3. Conducting a recovery exercise that measures actual elapsed time to restore the function. Correct answer.
  4. Confirming that backup tapes are stored offsite.

Explanation

Only a measured exercise reveals whether the function can actually be restored within the stated time, including dependencies and decision delays. Document review and offsite storage checks confirm intent and hygiene but not elapsed recovery performance. Comparing RTO to RPO does not test capability.

Question 47Business Impact Analysis and Recovery Objectives (RTO/RPO)

A business function depends on a database, an identity service, and a network segment. How should the RTO for the function be reasoned about?

  1. Use the longest RTO among the components as the function's RTO.
  2. Ignore dependencies because only the primary application matters.
  3. Use the shortest RTO among the supporting components.
  4. Recognize that all dependencies must be restored within the function's RTO, so the component recovery sequence must fit inside that window. Correct answer.

Explanation

A function is unavailable until every dependency it needs is restored, so component recovery times and their sequence must fit within the function's RTO. Taking the shortest or longest component value is not a valid substitute for dependency-aware planning. Ignoring dependencies produces plans that fail in execution.

Question 48Business Impact Analysis and Recovery Objectives (RTO/RPO)

Which statement correctly describes how RPO influences backup and replication design?

  1. The RPO sets the physical distance required between data centers.
  2. The RPO determines the maximum acceptable interval between recovery points, guiding backup frequency or replication mode. Correct answer.
  3. The RPO defines how long the restore operation may take.
  4. The RPO determines the number of staff required in the recovery team.

Explanation

RPO constrains how much data may be lost, which translates into how frequently recovery points must be captured or how continuously data must be replicated. Restore duration is governed by RTO, while staffing and site distance are design considerations driven by other requirements.

Question 49Business Impact Analysis and Recovery Objectives (RTO/RPO)

An executive asks why the BIA cannot simply adopt a uniform four-hour RTO for every system. Which rationale is strongest?

  1. Uniform objectives are prohibited by most standards.
  2. Systems differ in business criticality and impact over time, so uniform targets overprotect low-impact systems and may underprotect critical ones. Correct answer.
  3. Uniform objectives are technically impossible to implement.
  4. Only the IT department may set objectives, and it prefers variety.

Explanation

Objectives should be tiered to business impact so investment is directed where disruption causes the greatest harm. A single blanket target either overspends on non-critical systems or fails critical ones whose tolerance is shorter. Standards generally encourage impact-based differentiation rather than prohibiting uniformity outright.

Question 50Business Impact Analysis and Recovery Objectives (RTO/RPO)

A regulator requires that certain records be recoverable to within one hour of the event of loss. How should this requirement be treated in the BIA?

  1. As a minimum RPO constraint that overrides any looser internal objective. Correct answer.
  2. As an MTTR target for the storage team.
  3. As an optional guideline that applies only during audits.
  4. As an RTO because it mentions an hour.

Explanation

A mandated data-recovery window is a mandatory RPO constraint, and internal objectives cannot be looser than the regulatory floor. It constrains data loss, so it is not an RTO despite the time unit. Regulatory requirements are binding inputs to the BIA rather than optional guidance.