An IT auditor is reviewing the 'Recovery Point Objective' (RPO) for a critical transaction database. Management has set the RPO at 1 hour. The current backup strategy involves a full backup every Sunday at midnight and incremental backups every night at midnight. Is this strategy adequate?

Answer options:

Yes, because incremental backups capture daily changes.

Yes, provided the transaction logs are backed up daily.

No, the RPO requires a differential backup strategy.

No, backing up once every 24 hours cannot meet a 1-hour data loss limit.

How to approach this question

Compare the frequency of backups (24 hours) to the RPO (1 hour).

Full Answer

D.No, backing up once every 24 hours cannot meet a 1-hour data loss limit.✓ Correct

RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time. A 1-hour RPO requires data to be backed up (or replicated) at least every hour. A daily backup schedule implies a potential data loss of up to 24 hours, which fails to meet the objective.

Common mistakes

Confusing RPO (data loss) with RTO (downtime).

Question 10 All questions Question 12

Practice the full CPA ISC Practice Exam 3

82 questions · hints · full answers · grading

More questions from this exam

Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...Medium Q02During a review of a client's cloud governance structure, an auditor notes that the client uses a...Medium Q03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...Hard Q04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...Hard Q05During a walkthrough of the change management process, an auditor observes that the 'Developer' r...Medium

View all 82 questions →