Skip to content

CMA Final · Cost and Management Audit · Information Systems Security Audit

A firm's disaster recovery plan states that after an outage, systems must be running within 4 hours, and that no more than 30 minutes of transaction data may be lost. Which pair correctly identifies these two measures?

Four hours is the Recovery Time Objective, the maximum time allowed to restore systems, and thirty minutes is the Recovery Point Objective, the maximum amount of data loss, measured in time, that the business can tolerate. The reversed pairing confuses restoration time with acceptable data loss.

  1. A4 hours is the Recovery Time Objective; 30 minutes is the Recovery Point ObjectiveCorrect
  2. B4 hours is the Recovery Point Objective; 30 minutes is the Recovery Time Objective
  3. CBoth are Recovery Time Objectives
  4. DBoth are Recovery Point Objectives

Explanation

RTO is the maximum tolerable time to restore service, here 4 hours. RPO is the maximum tolerable data loss measured in time, here 30 minutes. The reversed option swaps the definitions.

Did you get it right without looking?

One question tells you little. A timed set on Information Systems Security Audit shows your real accuracy, how long you take and where you lose marks.

Practise Information Systems Security AuditFree diagnostic mock

More Information Systems Security Audit questions