An internal reporting application has a business impact analysis showing a maximum tolerable downtime of five days and an acceptable data loss of twenty-four hours. Management wants the least costly disaster recovery approach that still meets these targets. Which strategy should the cloud security professional recommend?

Recovery strategy selection starts from the business impact analysis: the tolerated outage and data loss set the floor, and cost decides among the strategies that clear it. Backup and restore keeps no running infrastructure in the recovery location; data is backed up on a schedule that satisfies the recovery point objective, and the environment is rebuilt from templates or images only when a disaster is declared. A daily backup copied to a separate region meets a twenty-four-hour data loss tolerance, and a rebuild measured in hours fits comfortably within five days. Pilot light keeps data continuously replicated and the core ready to start, which buys faster recovery the business has said it does not need, at the cost of continuous replication and standing resources. Warm standby runs a scaled-down but live copy, adding steady compute spend for minutes-level recovery that a five-day tolerance does not justify. Active-active doubles production capacity for near-zero recovery, the most expensive option on the curve. Exam caveat: when a question names a cost constraint, the correct strategy is the cheapest one that still meets RTO and RPO, not the most resilient one. Operational check: confirm backups land in a separate location, are encrypted and immutable where possible, and that a timed restore test finishes well inside the downtime limit.