A payment authorization service runs in a single cloud region. Its business impact analysis requires that customers see no meaningful interruption and lose no committed transactions if that region fails, so both the RTO and the RPO are near zero. The board has approved a large resilience budget. Which disaster recovery strategy best fits?

Disaster recovery strategies sit on a cost-versus-recovery-speed curve. Active-active, sometimes called multi-site, runs full production capacity in two or more locations at the same time, with data kept synchronized and traffic distributed between them. When one region fails, the remaining site is already serving customers, so recovery time and data loss approach zero; the price is paying for duplicate capacity and handling replication complexity. Warm standby keeps a functional but reduced copy running elsewhere; it recovers in minutes, but scaling and promotion still create an interruption that this requirement does not allow. Pilot light replicates only the critical data and keeps the remaining tiers off or minimal, so failover means provisioning and starting the application tier, which takes longer again. Backup and restore is the cheapest approach and the slowest: an hourly snapshot already implies up to an hour of lost data, and rebuilding the environment can take hours. Exam caveat: the strategy is chosen after the BIA sets RTO and RPO, and the budget only matters once the requirement is known; a large budget alone never justifies active-active. Operational check: confirm the replication mode actually delivers the stated RPO, and exercise a regional failover to prove the surviving site absorbs full load.