Do you know the differences between RTO and RPO? Even if you know what the acronyms mean, (recovery time objective for RTO and recovery point objective for RPO), they can still be a little confusing.
As an example, can you answer this sample Security+ question?
Q. You are helping implement your company’s business continuity plan. For one system, the plan requires an RTO of five hours and an RPO of one day. Which of the following would meet this requirement?
A. Ensure the system can be restored within five hours and ensure it does not lose more than one day of data.
B. Ensure the system can be restored within one day and ensure it does not lose more than five hours of data.
C. Ensure the system can be restored between five hours and one day after an outage.
D. Ensure critical systems can be restored within five hours and noncritical systems can be restored within one day.
Can you answer the question? More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Full Security+ Course
SY0-601 Full Security+ Course
Helping you Pass the First Time
This course includes all of the multiple-choice practice test questions, performance-based questions, audio, and flashcards from the but adds the CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide within an online course.
Test your readiness with these quality materials
Here’s what you get
Random 75-question tests
Random practice tests from the all of the practice test questions in the
CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide. All questions include explanations so you’ll know why the correct answers are correct, and why the incorrect answers are incorrect.
Performance-based Questions
These questions show you what you can expect in the live exam. They include drag and drop, matching, sorting, and fill in the blank questions.
Online Flashcard Set
Audio – SY0-601 Security+ Remember This Audio Files
Learn by Listening (MP3 downloads.)
Audio – SY0-601 Security+ Question and Answer Audio Files
Learn by Listening (MP3 downloads.)Bonus #1
The same set of questions organized by domain including questions in the
CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide plus extra practice test questions.
Bonus #2
Audio from the end of chapter reviews from each of the chapters in the
CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide.
Bonus #3
Access to all of the online content that is available for free to anyone that purchases the CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide. This includes labs, extra practice test questions, and supplementary materials.Bonus #4
Extended access. Access the study materials for a total of 60 days because sometimes life happens.Bonus #5
10% off Voucher Code. Access to a coupon code that will give you 10% off your exam voucher. At the current price of $370 USD for the Security+ voucher, this can save you $37.Get the SY0-601 Full Security+ Course Here
Recovery Time Objective
The recovery time objective (RTO) identifies the maximum amount of time it can take to restore a system after an outage. Many BIAs identify the maximum acceptable outage or maximum tolerable outage time for critical services or business functions. If an outage lasts longer than this maximum time, the impact is unacceptable to the organization.
For example, imagine an organization that sells products via a web site generates $10,000 in revenue an hour. It might decide that the maximum acceptable outage for the web server is five minutes. With this in mind, the RTO is five minutes, indicating any outage must be limited to less than five minutes.
On the other hand, the organization may have a database server used by internal employees. Although the database server may be valuable, it is not critical. Management might decide they can accept an outage for as long as 24 hours, dictating an RTO less than 24 hours.
Recovery Point Objective
A recovery point objective (RPO) identifies a point in time where data loss is acceptable. As an example, a server may host archived data that has very few changes on a weekly basis. Management might decide that some data loss is acceptable, but they always want to be able to recover data from at least the previous week. In this case, the RPO is one week.
With an RPO of one week, administrators would ensure that they have at least weekly backups. In the event of a failure, they will be able to restore recent backups and meet the RPO.
In some cases, the RPO is up to the minute of the failure. For example, any data loss from an online database recording customer transactions might be unacceptable. In this case, the organization can use a variety of techniques to ensure administrators can restore data up to the moment of failure.

Remember this
The recovery time objective (RTO) identifies the maximum amount of time it should take to restore a system after an outage. It is derived from the maximum allowable outage time identified in the BIA. The recovery point objective (RPO) refers to the amount of data you can afford to lose.
CompTIA Security+ Study Guide
The
CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide
is an update to the top-selling SY0-201, SY0-301, SY0-401, and SY0-501 study guides, which have helped thousands of readers pass the exam the first time they took it. It includes the same elements readers raved about in the previous four versions.
Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.

Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Kindle edition also available.
Q. You are helping implement your company’s business continuity plan. For one system, the plan requires an RTO of five hours and an RPO of one day. Which of the following would meet this requirement?
A. Ensure the system can be restored within five hours and ensure it does not lose more than one day of data.
B. Ensure the system can be restored within one day and ensure it does not lose more than five hours of data.
C. Ensure the system can be restored between five hours and one day after an outage.
D. Ensure critical systems can be restored within five hours and noncritical systems can be restored within one day.
Answer is A. The recovery time objective (RTO) identifies the maximum amount of time it should to take to restore a system after an outage.
The recovery point objective (RPO) refers to the amount of data you can afford to lose.
RTO only refers to time, not data. RPO refers to data recovery points, not time to restore a system.
Security+ (SY0-601) Practice Test Questions
SY0-601 Practice Test Questions
Over 385 realistic Security+ practice test questions
At least 10 performance-based questions
All questions include explanations so you’ll know why the correct answers are correct,
and why the incorrect answers are incorrect.
Upgrade Your Resume with the Security+ New Version
Multiple quiz formats to let you use these questions based on the way you learn.
- Learn mode – randomized. View each of the questions in random order. Learn mode allows you to keep selecting answers until you select the correct answer. Once you select the correct answer, you’ll see the explanation. Click here to see how learn mode works.
- Test mode – randomized. View each of the questions in random order. In test mode, you can only see the correct answers and explanations after you complete the test. Click here to see how test mode works.
- Test mode – 75 random questions. View 75 random questions from the full test bank similar to how the Security+ exam has a potential maximum of 75 multiple choice questions.
Pass the First Time You Take It
Get the full bank of SY0-601 Practice Test Questions Here
Click here if you’re looking for SY0-501 Online Study Package
See Chapter 9 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on business continuity concepts.