Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A payments firm sets a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes for its card authorization system. Backups are replicated every 30 minutes, and failover takes 3 hours. Which statement is correct?

The RTO is met but the RPO is not. Failover takes 3 hours, within the 4-hour recovery time objective, but replication every 30 minutes means up to 30 minutes of data could be lost, which exceeds the 15-minute recovery point objective.

  1. AThe RTO is met but the RPO is not, because up to 30 minutes of data could be lostCorrect
  2. BBoth objectives are met
  3. CThe RPO is met but the RTO is not, because failover takes 3 hours
  4. DNeither objective is met

Explanation

RPO measures tolerable data loss. With replication every 30 minutes, up to 30 minutes of transactions could be lost, exceeding the 15-minute RPO. Failover of 3 hours is within the 4-hour RTO, so the RTO is met.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions