Free Security+ practice test, with the reasoning shown

A company buys a batch of routers from an authorized reseller. Inspection later finds an extra chip soldered onto each circuit board that gives an outside party a backdoor. Which of the following best describes this attack?

Use Check on the answer you favor. The verdict shows up with a short note on each choice.

1. Software supply chain attack
   Check

   A software supply chain attack tampers with code, updates or libraries; here the implant is a piece of hardware on the board.
2. On-path attack
   Check

   An on-path attacker intercepts traffic between two parties; the risk here is the compromised device itself, not interception in transit.
3. Malvertising
   Check

   Malvertising spreads malware through online ads and has nothing to do with physically altered routers.
4. Hardware supply chain attack
   Check

   The backdoor is a physical component added to the devices somewhere between manufacture and delivery, which makes this a hardware supply chain compromise.
5. Insider threat
   Check

   An insider threat would come from someone inside the buying company; the routers arrived already tampered with.

A system administrator discovers that key financial records were deleted by a script triggered the day after an employee was terminated. An investigation reveals the script was planted on a server by that employee before their departure. Which of the following best classifies the threat actor and their primary motivation?

1. Hacktivist, ideological beliefs
   Check

   Hacktivists attack to publicize a cause; a quiet deletion timed to one employee's firing points to a personal motive.
2. Organized crime, espionage
   Check

   Organized crime chases money and espionage steals information; this attack destroyed records instead of taking them.
3. Nation-state actor, sabotage
   Check

   A nation-state actor is a government-backed team; this script came from the company's own former employee, so the actor is wrong whatever the motive.
4. Unskilled attacker, financial gain
   Check

   Unskilled attackers use ready-made tools from outside; this attack needed earlier server access, and deleting records earns nothing.
5. Malicious insider, revenge
   Check

   A just-fired employee used inside access to plant a destructive script set to run after they left: insider access plus a grudge.

A critical vulnerability is being actively exploited on production servers, and the vendor has just released a patch that must be deployed immediately. According to proper change management practices, which of the following is the BEST approach?

1. Treat it as a standard pre-approved change and deploy it
   Check

   Standard changes are routine, low-risk changes approved in advance; an urgent patch to production servers under active attack is an emergency change and needs its own approval.
2. Apply the patch at once and bypass the change process completely
   Check

   Bypassing the process leaves the change unapproved and untracked; emergency procedures exist so that speed doesn't mean no control.
3. Deploy the patch now and record it at the next maintenance window
   Check

   Deploying now and recording the change at the next maintenance window skips any approval and any rollback plan, both of which still apply in an emergency.
4. Hold the patch until the next scheduled CAB meeting approves it
   Check

   Waiting for the regular meeting leaves servers exposed to an exploit already in use; the emergency path exists for this case.
5. Get emergency CAB approval and a rollback plan, then document
   Check

   An emergency CAB gives fast-track approval, a rollback plan covers a patch that breaks production, and the full write-up and review follow deployment.

A corporate security policy requires that all laptop hard drives be encrypted with full-disk encryption, and the encryption keys must be stored in a hardware chip on the motherboard that resists physical tampering. Which technology meets this requirement?

1. Hardware Security Module (HSM)
   Check

   An HSM is a dedicated appliance or card that protects many keys in a data center; it isn't a chip built into each laptop's motherboard.
2. UEFI Secure Boot
   Check

   Secure Boot checks that boot code is signed before it runs; it doesn't store disk encryption keys.
3. Trusted Platform Module (TPM)
   Check

   A TPM is a tamper-resistant chip on the motherboard that stores and protects full-disk encryption keys, releasing them only when the boot measurements check out.
4. Software-based key escrow
   Check

   Escrowing keys in software keeps a recovery copy elsewhere; it isn't hardware on the motherboard and doesn't resist physical tampering.
5. Self-encrypting drive (SED)
   Check

   A self-encrypting drive keeps its key in the drive's own controller, not in a chip on the motherboard as the policy requires.

A certificate authority revokes a TLS certificate because its private key was compromised. The security team wants client applications to check one certificate at a time in real time, without downloading a periodically published list. Which protocol should be implemented?

1. HTTP Strict Transport Security (HSTS)
   Check

   HSTS tells browsers to reach a site only over HTTPS; it doesn't check certificate revocation.
2. Domain Name System Security Extensions (DNSSEC)
   Check

   DNSSEC signs DNS records so answers can't be forged; it says nothing about whether a certificate was revoked.
3. Online Certificate Status Protocol (OCSP)
   Check

   OCSP lets a client ask a responder about a single certificate and get a current good, revoked or unknown answer instead of waiting for the next list.
4. Simple Certificate Enrollment Protocol (SCEP)
   Check

   SCEP automates requesting and enrolling certificates, the start of a certificate's life, not checking whether it was revoked.
5. Certificate Revocation List (CRL)
   Check

   A CRL is the periodically published list the team wants to avoid; a client can miss a revocation until it downloads the next update.

A Security Operations Center (SOC) deploys a Security Information and Event Management (SIEM) system that aggregates logs and generates real-time alerts for detected anomalies. Which of the following best classifies this SIEM implementation?

1. Technical Detective
   Check

   A SIEM is a technology-based control (technical) whose job is to spot suspicious events and raise alerts (detective).
2. Technical Preventive
   Check

   The category fits, but a SIEM that aggregates logs and raises alerts blocks nothing, so it isn't preventive.
3. Operational Detective
   Check

   Operational controls are carried out mainly by people, such as staff reviewing logs; the SIEM itself is a technical system even though a SOC runs it.
4. Managerial Detective
   Check

   Managerial controls are policies, risk assessments and program reviews; a log-correlating platform is not a management practice.
5. Physical Detective
   Check

   Physical detective controls are things like cameras and motion sensors in a facility; a SIEM works on log data, not physical space.

A security analyst discovers that a cloud storage bucket used by the marketing department contains customer personally identifiable information (PII) and can be read by anyone with the URL, with no authentication required. Which type of vulnerability best describes this exposure?

1. Hardware security flaw
   Check

   Bucket permissions are a software setting the customer controls, not a flaw in physical components.
2. Unpatched software
   Check

   Unpatched software means a vendor fix exists but wasn't applied; no update is missing here, and patching wouldn't close the exposure.
3. Zero-day vulnerability
   Check

   A zero-day is a flaw the vendor doesn't know about yet; nothing like that was exploited, public access was simply allowed.
4. DNS poisoning
   Check

   DNS poisoning redirects name lookups to an attacker's address; here the real bucket itself was left open.
5. Misconfiguration
   Check

   The storage service worked as designed; someone set its access to public, and that insecure setting is a misconfiguration.

Over an 18-month period, a threat actor has maintained hidden access to a government network, exfiltrating hundreds of classified documents without any service disruption or ransom demand. Which of the following is the most likely type of threat actor?

1. Organized crime group
   Check

   Criminal groups want a payoff and usually cash in quickly through ransom or data sales; a silent 18-month operation with no monetization doesn't fit.
2. Hacktivist collective
   Check

   Hacktivists want attention for a cause, typically through leaks, defacements or outages; this actor stayed hidden.
3. Nation-state group
   Check

   Eighteen months of quiet access to steal classified documents, with no money demanded and no disruption, fits a nation-state group running espionage with the resources and patience for it.
4. Unskilled attacker
   Check

   An unskilled attacker relying on off-the-shelf tools couldn't stay hidden inside a government network for 18 months.
5. Malicious insider
   Check

   An insider already has legitimate access and wouldn't need to keep a hidden foothold, and the target and patience suggest a resourced outside actor.

To prevent malicious or unapproved executables and scripts from running on corporate laptops, an administrator wants to implement a default-deny approach. Which mitigation technique is MOST appropriate?

1. Deploy next-generation antivirus
   Check

   Antivirus, even next-generation, blocks what it recognizes as bad and lets the rest run, so it is default-allow rather than default-deny.
2. Encrypt all files on each host
   Check

   Encryption protects the confidentiality of files; it doesn't control which programs are allowed to run.
3. Apply operating system updates regularly
   Check

   Updates fix known vulnerabilities but don't stop a user from launching an unapproved executable or script.
4. Enforce application allowlisting
   Check

   An allowlist lets only approved executables and scripts run and blocks everything else, which is a default-deny rule for code execution.

A security analyst reviews two advisories: one requires an operating system update to patch a buffer overflow vulnerability, and the other requires a BIOS update to fix a flaw in the CPU microcode. Which of these advisories represents a hardware vulnerability?

1. Both advisories represent hardware vulnerabilities
   Check

   Calling both advisories hardware issues misses that the operating system's buffer overflow lives in software.
2. The advisory that calls for an OS update
   Check

   The OS update advisory fixes a buffer overflow in operating system code, which is a software flaw even though it runs on the same machine.
3. Neither advisory represents a hardware vulnerability
   Check

   Saying neither is hardware misses that a CPU microcode flaw stays a processor flaw even when a BIOS update delivers the fix.
4. The advisory that calls for a BIOS update
   Check

   The BIOS update advisory is the hardware one: the flaw sits in the processor's microcode, and the firmware update only delivers the fix.

An organization's disaster recovery plan states: 'We have a redundant server cluster with automatic failover in our main data center, so we are protected against any disaster.' What is the primary flaw in this statement?

1. Failover mechanisms cause excessive downtime
   Check

   Automatic failover keeps downtime short when a server fails; downtime caused by failover isn't the flaw in the claim.
2. A site-wide event would take down the whole cluster
   Check

   A cluster in one data center covers server failures, but a fire, flood or regional power loss at that site takes out every node at once; disaster recovery needs a second location.
3. Redundant clusters lack data encryption
   Check

   Encryption protects confidentiality and has nothing to do with surviving a disaster; redundancy and encryption are separate concerns.
4. Clustered servers cannot be part of a disaster recovery plan
   Check

   Clusters are often part of recovery plans; the flaw is relying on one site for any disaster, not clustering itself.
5. Automatic failover is unreliable for high availability
   Check

   Automatic failover is a standard, dependable high-availability technique; the problem is where the cluster sits, not how it fails over.

A development team deploys an in-house web application to a PaaS environment. Shortly after launch, an attacker exploits a SQL injection flaw in the login form to dump the user database. According to the cloud shared responsibility model, who is ultimately responsible for this breach?

1. The database engine vendor
   Check

   SQL injection exploits how the application builds its queries, not a flaw in the database software, so the engine's maker isn't at fault.
2. The third-party auditor
   Check

   An auditor assesses and reports on controls; it doesn't take on responsibility for the systems it reviews.
3. The cloud provider
   Check

   The provider secures the underlying platform; it doesn't write or validate the customer's login form.
4. The customer
   Check

   In PaaS the provider runs the platform, OS and runtime, while the customer owns its application code and data; an injection flaw in that code is the customer's responsibility.
5. Both equally
   Check

   Responsibility is split by layer, not shared equally, and the vulnerable layer here, the application code, belongs entirely to the customer.

An e-commerce website is under attack. Attackers submit malicious SQL queries in the search form to extract customer data, and inject scripts that steal session cookies from other users. The security team needs to deploy an appliance that can inspect HTTP messages and block these attacks. Which appliance and OSI layer should be chosen?

1. Next-Generation Firewall at Layer 4
   Check

   Next-generation firewalls can inspect applications, but this option pins the choice to Layer 4, where only ports and connections are visible and the HTTP content is not.
2. Web Application Firewall at Layer 7
   Check

   A web application firewall works at Layer 7, parsing HTTP requests and responses and blocking patterns such as SQL injection and injected scripts in form fields.
3. Stateful Firewall at Layer 4
   Check

   A stateful firewall tracks connections and ports; it lets HTTP through without reading the query text or scripts inside it.
4. Reverse Proxy at Layer 5
   Check

   HTTP isn't a Layer 5 protocol, and a plain reverse proxy forwards and caches requests without being built to detect injection attacks.
5. Intrusion Prevention System at Layer 3
   Check

   An intrusion prevention system limited to Layer 3 sees IP addresses and routing, not the HTTP form fields where these attacks live.

A company uses round-robin DNS to distribute web traffic between two servers. After one server fails, users experience intermittent failures. What is the root cause?

1. DNS never checks whether each server is still up.
   Check

   Round-robin DNS has no health checks, so it keeps handing out the dead server's address in rotation and some clients keep failing.
2. Network latency causes timeouts.
   Check

   Network latency would slow every request, including those to the working server, instead of causing failures only some of the time.
3. The firewall denies traffic from the failed server.
   Check

   A failed server isn't sending any traffic; the issue is clients being sent to it, not a firewall rule.
4. DNS cache TTL is set too low.
   Check

   A short TTL makes clients look up the name again sooner, which helps rather than causes the problem; the dead address stays in rotation either way.
5. The load balancer is stuck in active-passive failover.
   Check

   There is no load balancer in this setup, only round-robin DNS, so no failover mode can be the cause.

A payment processing company discovers that its application logs contain full credit card numbers. It must keep the numbers out of the logs, still retrieve an original number for a transaction dispute, and store a substitute value that has no mathematical relationship to the card number. Which technical method should be implemented?

1. Format-Preserving Encryption
   Check

   Format-preserving encryption keeps the 16-digit layout, yet it is still encryption: the output is derived from the card number with a key.
2. Hashing
   Check

   A hash is one-way, so the original number can't be retrieved for a dispute, and it is still derived from the number.
3. Encryption
   Check

   Encryption is reversible, but its ciphertext is computed from the card number with a key, which is exactly the mathematical relationship the requirement rules out.
4. Data Masking
   Check

   Masking hides part of the number, for example all but the last four digits; the hidden digits are gone from that copy, so the full number can't be retrieved from it.
5. Tokenization
   Check

   Tokenization swaps each card number for a random token and keeps the mapping in a secured vault, so the original can be looked up when needed while the token itself reveals nothing.

Employees use their personal smartphones for work under a BYOD policy, so personal apps and data share each device with corporate data. To keep corporate data from leaking into personal apps, which technique should be implemented?

1. Geofencing
   Check

   Geofencing applies rules based on the device's location; it doesn't separate work data from personal apps.
2. Containerization
   Check

   Containerization puts work apps and data in a separate, encrypted, managed space on the phone and controls what can move between it and personal apps.
3. Remote wipe
   Check

   Remote wipe is a reaction after loss and, on a personal phone, could erase personal data too; it doesn't prevent day-to-day leakage.
4. Full-disk encryption
   Check

   Encrypting the whole device protects data if the phone is stolen, but once it is unlocked nothing stops corporate data moving into personal apps.

During a security incident, an organization detects unusual outbound traffic and confirms a data breach. The incident response team disconnects the affected server from the network but keeps it powered on. Which phase of the incident response lifecycle does this action represent?

1. Eradication
   Check

   Eradication removes the threat, such as malware or attacker accounts; unplugging the server doesn't remove anything.
2. Identification
   Check

   The breach was already detected and confirmed; this step limits damage rather than identifying the incident.
3. Preparation
   Check

   Preparation happens before incidents, such as building the plan and tools; this action responds to a live breach.
4. Recovery
   Check

   Recovery returns systems to normal service after eradication; a disconnected server isn't back in service.
5. Containment
   Check

   Cutting the server off from the network stops the breach from spreading or sending more data, while leaving it on preserves evidence; that is containment.

During user onboarding, a script automatically assigns one of three RBAC roles based on department. What is the primary security benefit of this automation?

1. Improved audit trail generation
   Check

   Audit trails are a by-product of automation; the security gain the scenario describes is correct, minimal access for each role.
2. Faster account provisioning for new employees
   Check

   Speed is an operational benefit; a faster account isn't a more secure one.
3. Automated creation of user accounts in directory
   Check

   Creating directory accounts automatically restates what the script does rather than naming a security benefit.
4. Consistent least privilege for every new hire
   Check

   Assigning roles by rule gives each new hire the same predefined, minimal access for their department, removing the guesswork and over-granting of manual setup.
5. Reduced need for administrator training
   Check

   Less admin training is a cost or staffing benefit and has nothing to do with protecting access.

An organization launches a public initiative that invites external security researchers to find vulnerabilities in its web application and offers monetary rewards for valid reports. What is this called?

1. Internal penetration test
   Check

   An internal penetration test uses the organization's own or contracted testers under a set scope, not the public.
2. Vulnerability scanning service
   Check

   A scanning service runs automated tools against systems; it doesn't invite outside researchers or pay per finding.
3. Red team exercise
   Check

   A red team is an in-house or hired group emulating an adversary in a planned engagement; it isn't open to anyone who wants to join.
4. Bug bounty program
   Check

   A bug bounty openly invites outside researchers to find and report vulnerabilities and pays for valid findings.
5. Responsible disclosure policy
   Check

   A disclosure policy tells outsiders how to report flaws safely, but on its own it doesn't promise payment for valid reports.

An intrusion detection system alerts on a PDF reader process spawning a command shell. Antivirus signature scans find no matches. The event is later confirmed as a zero-day exploit. Which detection method most likely triggered the alert?

1. Hash reputation lookup
   Check

   Checking file hashes against known-bad lists is another way of matching known items, so a new exploit wouldn't show up there.
2. Signature-based detection
   Check

   Signatures match only known attack patterns; a zero-day has none, which is why the antivirus scan found nothing.
3. Static file analysis
   Check

   Static analysis examines a file without running it; this alert fired on a process's live behavior.
4. Full-disk encryption
   Check

   Full-disk encryption protects data at rest and doesn't monitor or alert on anything.
5. Anomaly-based detection
   Check

   Anomaly-based (behavioral) detection flags activity that departs from normal, like a PDF reader launching a command shell, so it can catch exploits no signature describes yet.

Which of the following best describes the primary objective of an internal security audit?

1. Identify policy violations and evaluate controls
   Check

   Internal auditors check whether the organization follows its own policies and whether its controls work, and report findings to management or an audit committee.
2. Certify the organization against an external standard
   Check

   Certification to a standard such as ISO 27001 is granted by an outside certification body, not by the organization's own auditors.
3. Provide an independent attestation of financial statements
   Check

   An independent attestation must come from an outside firm; staff can't independently attest to their own organization.
4. Scan systems for technical vulnerabilities
   Check

   Vulnerability scanning is a technical tool; an audit reviews controls and policy compliance and may use scan results, but it isn't the scan.
5. Simulate attacks to test defensive capabilities
   Check

   Simulating attacks describes penetration testing or red teaming, a technical exercise rather than an audit of controls and policies.

A former customer in the EU asks a company to delete all personal data it holds about them. No law requires the company to keep that data. Which data subject right is the customer exercising?

1. Right to data portability
   Check

   Data portability lets a person receive their data in a usable format or have it moved to another provider; nothing gets deleted.
2. Right of access
   Check

   The right of access lets a person see what data is held about them and how it is used, not have it removed.
3. Right to be forgotten
   Check

   The right to be forgotten (the GDPR right to erasure) lets a data subject have their personal data deleted when no legal obligation or other overriding ground requires keeping it.
4. Right to rectification
   Check

   Rectification corrects inaccurate or incomplete data; this customer wants the data gone, not fixed.
5. Right to restrict processing
   Check

   Restricting processing pauses use of the data while it stays stored, which falls short of deleting it.

An administrator at a hospital configures user access permissions on the electronic health record (EHR) system, ensures daily backups are performed, and applies security patches as directed by the department head responsible for the records. Which data security role does this administrator fulfill?

1. Data custodian
   Check

   A custodian handles the day-to-day care of data, such as access settings, backups and patching, according to rules set by someone else.
2. Data processor
   Check

   A processor is a separate party, such as an outside vendor, processing data on the controller's behalf; this administrator is the hospital's own staff.
3. Data owner
   Check

   The owner decides classification and who may have access and is accountable; this administrator carries out those decisions.
4. Data controller
   Check

   A data controller is the organization that decides why and how personal data is processed, a privacy-law role, not an individual administrator.

An attacker phones an employee, claims to be from the IT help desk, and talks them into reading out their VPN credentials. Which type of attack is this?

1. Smishing
   Check

   Smishing uses SMS text messages as the lure; this attacker made a voice call.
2. Vishing
   Check

   Vishing is voice phishing: social engineering over a phone call, here using a help desk pretext to get credentials.
3. Watering hole attack
   Check

   A watering hole attack infects a website the victims tend to visit; it doesn't involve calling anyone.
4. Whaling
   Check

   Whaling targets senior executives with tailored lures; the victim here is an ordinary employee reached by phone.
5. Business email compromise
   Check

   BEC uses a compromised or spoofed business email account, usually to redirect payments; no email was involved.

A data center's diesel generator needs about 30 seconds to start and stabilize after a utility power failure. The servers must not lose power at any point during that gap. Which component should be installed between the utility feed and the servers?

1. Uninterruptible power supply (UPS)
   Check

   A UPS supplies power from its batteries the instant utility power drops and carries the load for minutes, long enough for the generator to start and take over.
2. A second standby diesel generator
   Check

   A second generator has the same start-up delay, so the servers would still go dark for those first seconds; it adds capacity for long outages, not instant coverage.
3. Dual power supplies in every server
   Check

   Dual power supplies protect against a failed supply inside a server, but when both are fed from the failed utility they lose power together.
4. Managed power distribution units (PDUs)
   Check

   Managed PDUs distribute and monitor power to the equipment in a rack; they store no energy and can't carry the load through an outage.
5. Surge protectors on each rack circuit
   Check

   Surge protectors absorb voltage spikes; when utility power disappears entirely they have nothing to pass on.

A malware analyst needs to safely execute a suspicious executable to observe its behavior without risking the production network. Which of the following is the BEST technique?

1. Sandbox detonation
   Check

   Detonating the file in a sandbox runs it in an isolated, instrumented environment that records its behavior while keeping it away from production systems.
2. Code signing
   Check

   Code signing shows who published a file and that it wasn't altered; it says nothing about what the file does when run.
3. Host-based firewall
   Check

   A host-based firewall filters one machine's network traffic; running the malware on a protected host still exposes that host.
4. Data loss prevention
   Check

   Data loss prevention watches for sensitive data leaving the organization; it doesn't provide a safe place to run and observe malware.
5. Patch management
   Check

   Patching closes known vulnerabilities on systems; it gives the analyst no isolated environment for running the sample.

An organization must ensure all new servers meet CIS Benchmarks before deployment. What is the BEST automated solution?

1. A file integrity monitoring (FIM) tool
   Check

   File integrity monitoring alerts when watched files change after deployment; it doesn't score a new server's settings against a benchmark.
2. A patch management and deployment system
   Check

   Patch management installs updates; being fully patched doesn't show that settings such as services, policies and permissions meet the benchmark.
3. A SCAP-validated configuration compliance scanner
   Check

   A SCAP-validated scanner checks each server's settings against benchmark content in a standard format and reports pass or fail automatically before the server goes live.
4. A security information and event management (SIEM) platform
   Check

   A SIEM collects and correlates logs and events; it doesn't audit a server's configuration before deployment.
5. A configuration management database (CMDB) system
   Check

   A CMDB records assets and their relationships; it stores configuration items but doesn't test them against a benchmark.

Two partner companies will share a cloud-based application using an XML-based standard for exchanging authentication and identity assertions, so that users do not need separate credentials. Which protocol should be implemented?

1. OAuth 2.0
   Check

   OAuth 2.0 delegates authorization with access tokens, typically JSON-based; it isn't an XML standard for authentication assertions.
2. SAML 2.0
   Check

   SAML 2.0 passes signed XML assertions about a user's identity from the identity provider to a partner's service, giving single sign-on across organizations.
3. RADIUS
   Check

   RADIUS centralizes authentication for network access such as VPN or Wi-Fi; it isn't used to federate a web application between companies.
4. Kerberos
   Check

   Kerberos issues tickets inside one trusted domain or realm; it doesn't exchange XML identity assertions between partner companies over the web.

A mortgage processing department at a bank requires annual compliance training on protecting consumers' personal financial information. Which regulation mandates this training?

1. Health Insurance Portability and Accountability Act (HIPAA)
   Check

   HIPAA covers protected health information held by health plans, providers and their associates, not consumers' banking and loan data.
2. Payment Card Industry Data Security Standard (PCI DSS)
   Check

   PCI DSS is an industry standard for cardholder data set by the card brands, not a regulation covering mortgage customers' financial information.
3. Gramm-Leach-Bliley Act (GLBA)
   Check

   GLBA requires financial institutions such as banks and mortgage lenders to protect customers' nonpublic personal information; banks meet it through the federal banking agencies' safeguards guidelines (the FTC Safeguards Rule covers non-bank lenders), and both call for training the staff who handle that data.
4. Sarbanes-Oxley Act (SOX)
   Check

   SOX targets the accuracy of public companies' financial reporting and its internal controls, not the privacy of individual consumers' data.
5. General Data Protection Regulation (GDPR)
   Check

   GDPR is an EU privacy law; a US bank's duty to protect consumer financial information and train staff comes from GLBA.

A disaster recovery team determines that the critical order-processing system can tolerate no more than 4 hours of downtime and can afford to lose at most 30 minutes of data. Which metrics correctly describe the downtime limit and the data loss window, respectively?

1. RTO: 4 hours; MTBF: 30 minutes
   Check

   MTBF is the average running time between failures, a reliability measure; it doesn't express acceptable data loss.
2. RTO: 4 hours; RPO: 30 minutes
   Check

   RTO is the longest acceptable time to restore the system (4 hours); RPO is the most data loss, measured back in time, the business will accept (30 minutes).
3. MTTR: 4 hours; RPO: 30 minutes
   Check

   MTTR is the average time repairs actually take, a measured figure; a limit on tolerable downtime is set as an RTO.
4. RTO: 30 minutes; RPO: 4 hours
   Check

   Swapping the values sets RTO at 30 minutes and RPO at 4 hours, which would allow only half an hour of downtime but four hours of lost data.
5. MTTR: 30 minutes; MTBF: 4 hours
   Check

   MTTR and MTBF are measured reliability averages rather than recovery targets, and neither describes how much data may be lost.