ISC2 CISSP (Certified Information Systems Security Professional)Security and Risk ManagementMedium
An organization is evaluating backup solutions for its critical data. They are comparing a solution that backs up data every 24 hours (daily backups) with one that performs continuous data protection (CDP), mirroring changes as they occur. The organization has calculated the maximum tolerable data loss, or Recovery Point Objective (RPO), to be 4 hours. Which backup solution best meets this RPO requirement?
- ADaily backups, as they are simpler to manage.
- BContinuous Data Protection (CDP), as it minimizes data loss to near zero.
- CDaily backups, provided they are performed during off-peak hours.
- DContinuous Data Protection (CDP), but only if combined with offsite storage.
Show answer & explanationAnswer & explanation
Correct answer: B. Continuous Data Protection (CDP), as it minimizes data loss to near zero.
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. A 4-hour RPO means the organization can only tolerate losing up to 4 hours of data. Daily backups (24-hour cycle) would not meet this, as up to 24 hours of data could be lost. Continuous Data Protection (CDP) records every change, effectively reducing data loss to near zero, thus easily meeting a 4-hour RPO.
Why the other options are wrong
- A. Simplicity of management does not address the RPO requirement.
- C. Off-peak daily backups still mean up to 24 hours of potential data loss, failing the 4-hour RPO.
- D. Offsite storage is important for disaster recovery but does not inherently change how much data is lost (RPO); CDP itself addresses the RPO.
Recovery Point Objective (RPO)
The maximum tolerable amount of data that can be lost after a disruption, measured in time.
- Determines the frequency of data backups.
- Expressed in hours, minutes, or seconds.
- A lower RPO requires more frequent backups or continuous replication.
Memory trick: RPO: How much data can I lose? RTO: How fast must I be back?