Domain 3 of 6 · Chapter 5 of 5

Business Continuity & DR

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Cloud Security Professional premium course — no separate purchase.

Included in this chapter:

  • RTO, RPO, and RSL: three independent dials
  • The DR strategy spectrum: cost versus recovery time
  • From BIA to requirements to plan
  • Testing the plan and reading the exam stem

DR strategy spectrum: from cheapest-slowest to costliest-fastest

StrategyBackup & restorePilot lightWarm standbyMulti-site active-active
What runs between disastersData backups onlyMinimal core (DB replica, images)Scaled-down full copyFull capacity in 2+ sites
Typical recovery time (RTO)Hours to daysTens of minutesMinutesNear zero
Achievable RPOBackup interval (hours)Replication lag (minutes)Replication lag (seconds–minutes)Near zero
Steady-state costLowestLowMediumHighest
Failover effortFull rebuild + restoreScale up the restScale to production sizeNone (already serving)

Decision tree

Derive RTO / RPO from the BIA firstRTO tolerates hours to days?long outage acceptable?YesBackup & restorecheapest, RTO hours-daysNoRTO + RPO near zero?no lost transactions?YesActive-active2+ live sites, costliestNoTens of minutes OK?vs strict minutesYesPilot lightwarm DB + imagesNoWarm standbyscaled-down full stackAlways: test the plan, tabletop first
Cheat sheet

Cheat sheet

  • RPO is the data you can lose; RTO is how long you can be down
  • RPO is set by backup or replication frequency
  • RTO is shortened by a hotter standby, not by more backups
  • RSL is the percentage of capacity the recovered service must deliver
  • RTO and RPO sit on opposite sides of the failure point
  • Pick the cheapest DR strategy that still meets RTO and RPO
  • Backup and restore is cheapest but recovers in hours to days
  • Pilot light keeps a minimal core warm and scales the rest on failover
  • Warm standby runs a scaled-down full stack ready to scale up
  • Multi-site active-active gives near-zero RTO at the highest cost
  • Cloud DR usually fails over to another region or availability zone
  • Recovery targets are derived from the BIA, never assigned by intuition
  • RTO is set shorter than the maximum tolerable downtime
  • Business continuity is broader than disaster recovery, which it contains
  • A DR plan must define failback to primary, not just failover
  • An untested DR plan is an assumption, not a capability
  • Start DR testing low-risk and escalate as each level passes
  • A tabletop exercise validates a new plan with zero production risk
  • A parallel test runs recovery beside live production without risking it
  • Full interruption proves the plan but is the only test that can break it
  • Unacceptable data loss is an RPO problem; too-long downtime is an RTO problem
  • Resilience handles routine failures; declare a disaster only when it overflows
  • Synchronous replication is required for RPO of zero; cross-region sync adds too much latency
  • Async cross-region read replicas allow quick promotion with a small, non-zero RPO
  • For DNS-based failover, set the record TTL below the RTO
  • Point-in-time recovery restores a full backup then replays transaction logs to a chosen instant
  • Independent point-in-time backups are needed because replication propagates corruption
  • WORM compliance-mode retention locks block deletion by anyone, even admins, for SEC 17a-4
  • Archive storage tiers need hours to rehydrate, so they can blow a short RTO
  • An isolated recovery or test environment must share no identity, network, or storage with production

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in