Isaca CRISC Exam - Topic 10 Question 101 Discussion

Actual exam question for Isaca's CRISC exam

Question #: 101
Topic #: 10

When an organization's business continuity plan (BCP) states that it cannot afford to lose more than three hours of a critical application's data, the three hours is considered the application's:

AMaximum tolerable outage (MTO).

BRecovery point objective (RPO).

CMean time to restore (MTTR).

DRecovery time objective (RTO).

Show Suggested Answer

Suggested Answer: B

TheRecovery Point Objective (RPO)specifies the maximum tolerable period in which data might be lost due to an incident. In this case, the organization is indicating that it cannot afford to lose more than three hours of data, defining its RPO.

by Deandrea at Jul 10, 2025, 04:08 AM

Limited Time Offer

25%

Off

Get Premium CRISC Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Glenn

5 months ago

Nah, it's more about how quickly you can recover, that's RTO!

upvoted 0 times

...

Malcolm

5 months ago

Wait, I didn't know RPO was just about data loss time!

upvoted 0 times

...

Erin

6 months ago

I thought it was the Maximum Tolerable Outage (MTO)?

upvoted 0 times

...

Lynsey

6 months ago

Totally agree, RPO is the right term here!

upvoted 0 times

...

Billy

6 months ago

That's definitely the Recovery Point Objective (RPO).

upvoted 0 times

...

Adria

6 months ago

I feel like the answer could be RPO, but I also remember RTO being about recovery time. It’s confusing!

upvoted 0 times

...

Josefa

7 months ago

This question seems similar to one we practiced where we had to identify RTO and RPO. I might mix them up, though.

upvoted 0 times

...

Rose

7 months ago

I’m not entirely sure, but I remember something about Maximum Tolerable Outage (MTO) being related to how long a system can be down.

upvoted 0 times

...

Mirta

7 months ago

I think the three hours refers to the Recovery Point Objective (RPO), since it’s about how much data loss is acceptable.

upvoted 0 times

...

Kasandra

7 months ago

I'm pretty confident that the answer is D. Recovery time objective (RTO). The three-hour limit is referring to the maximum acceptable downtime for the critical application, not the data loss.

upvoted 0 times

...

Kate

7 months ago

Okay, I've got this. The question is specifically asking about the application's data loss limit, not the system downtime. So the correct answer must be B. Recovery point objective (RPO).

upvoted 0 times

...

Nicholle

7 months ago

Hmm, I'm a bit confused on this one. I know it has to do with business continuity, but I'm not sure if the three-hour limit is referring to data loss or system downtime. I'll have to think this through carefully.

upvoted 0 times

...

Josephine

8 months ago

This seems pretty straightforward. The question is asking about the term for the maximum amount of data loss that the organization can tolerate, so I think the answer is B. Recovery point objective (RPO).

upvoted 0 times

...

Dion

9 months ago

Wait, is the answer 'All of the above'? I mean, they're all important in a BCP, right? Kidding, kidding... I think B) Recovery point objective (RPO) is the way to go.

upvoted 0 times

Truman

8 months ago

User 2: No, I believe it's D) Recovery time objective (RTO).

upvoted 0 times

...

Serina

8 months ago

User 1: I think the answer is A) Maximum tolerable outage (MTO).

upvoted 0 times

...

Bernardo

9 months ago

So, the correct answer is indeed A) Maximum tolerable outage (MTO) because it aligns with the organization's BCP.

upvoted 0 times

...

Shaun

9 months ago

I feel like I should know this, but my brain is fried after all these exams. Let's see... I'm gonna have to go with C) Mean time to restore (MTTR). Fingers crossed!

upvoted 0 times

Hershel

8 months ago

I think it's D) Recovery time objective (RTO).

upvoted 0 times

...

Kiera

9 months ago

RPO is about the point in time to which you must recover data after an outage, not the maximum allowable downtime.

upvoted 0 times

...

Gilberto

9 months ago

But what about option B) Recovery point objective (RPO)? Isn't that also related to data loss?

upvoted 0 times

...

Bernardo

10 months ago

I agree with Kiera, because MTO is the maximum amount of time a system can be down before causing significant damage.

upvoted 0 times

...

Rozella

10 months ago

Haha, this is a tricky one! I'm going to have to go with A) Maximum tolerable outage (MTO). Sounds like the most logical answer to me.

upvoted 0 times

Alayna

8 months ago

User 1: I think it's B) Recovery point objective (RPO).

upvoted 0 times

...

Daniel

8 months ago

Actually, I think it's A) Maximum tolerable outage (MTO).

upvoted 0 times

...

Irving

9 months ago

I disagree, I believe it's D) Recovery time objective (RTO).

upvoted 0 times

...

Catalina

9 months ago

I think it's B) Recovery point objective (RPO).

upvoted 0 times

...

Kiera

10 months ago

I think the answer is A) Maximum tolerable outage (MTO).

upvoted 0 times

...

Leonard

10 months ago

Hmm, I'm not sure. Could it be D) Recovery time objective (RTO)? That's the maximum time the organization can afford to be without the critical application, right?

upvoted 0 times