SY0-701 Question 437
Single answerA healthcare provider is updating its business impact analysis for a patient scheduling application. During workshops, the operations team states the system can be unavailable for no more than 2 hours after an outage, and the business can tolerate losing no more than 15 minutes of appointment data. The infrastructure manager also reports that the application server typically operates for about 18 months before an unplanned hardware failure and, when a failure occurs, the team usually restores service in 90 minutes. Which option correctly maps these metrics to the appropriate business impact analysis and reliability terms?
- A
RTO = 2 hours, RPO = 15 minutes, MTBF = 18 months, MTTR = 90 minutes
- B
RPO = 2 hours, RTO = 15 minutes, MTTR = 18 months, MTBF = 90 minutes
- C
MTTR = 2 hours, MTBF = 15 minutes, RTO = 18 months, RPO = 90 minutes
- D
RTO = 15 minutes, RPO = 2 hours, MTBF = 90 minutes, MTTR = 18 months
Show answer and explanation
Correct answer: A
Explanation
In a business impact analysis, RTO and RPO are used to define recovery requirements for systems and data. RTO is the maximum tolerable time a service can remain unavailable after a disruption. RPO is the maximum tolerable amount of data loss, expressed as time between the last good backup/replication point and the disruption. MTTR and MTBF are operational reliability metrics: MTTR measures average time to restore or repair a failed component or service, while MTBF measures average uptime between failures for repairable systems. These definitions are consistent with common disaster recovery and business continuity guidance used across industry frameworks such as NIST Special Publication 800-34 for contingency planning and standard reliability engineering practices. On Security+, candidates are expected to distinguish business tolerance metrics (RTO/RPO) from maintenance and reliability metrics (MTTR/MTBF) and apply them correctly in realistic outage scenarios.
- A. Correct.
Correct. Recovery Time Objective (RTO) is the maximum acceptable downtime after a disruption, so the 2-hour outage tolerance is the RTO. Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time, so the 15-minute data-loss tolerance is the RPO. Mean Time Between Failures (MTBF) measures average operational time between failures for repairable systems, matching the 18 months between unplanned hardware failures. Mean Time To Repair (MTTR) is the average time required to restore service after a failure, matching the 90-minute restoration time.
- B. Incorrect.
Incorrect. This option reverses RTO and RPO and also swaps MTTR and MTBF. A common misconception is to treat downtime tolerance and data-loss tolerance as interchangeable, but they measure different business impacts. Likewise, 18 months describes time between failures, not time to repair, while 90 minutes describes repair duration, not reliability over time.
- C. Incorrect.
Incorrect. This option misclassifies all four metrics. The 2-hour figure is not MTTR because it represents the business's maximum tolerable outage, not the team's average actual repair time. The 15-minute figure is not MTBF because it reflects acceptable data loss, not equipment reliability. The 18-month and 90-minute values are also incorrectly assigned.
- D. Incorrect.
Incorrect. This option swaps both recovery objectives and reliability measures. Assigning 15 minutes to RTO would imply the application must be restored within 15 minutes, which is stricter than the stated business requirement. Assigning 2 hours to RPO would imply the organization can lose up to 2 hours of data, which contradicts the stated 15-minute tolerance.