A city defines RPO of 1 hour and RTO of 4 hours for the building-permit system and wants the lowest ongoing DR cost that still meets those targets. Which DR strategy fits?
Select an answer to reveal the explanation.
Short Explanation
An hour of data and four hours to get back online is the classic “restore from backups” neighborhood—not the always-on twin-city price tag.
Full Explanation
Backup and restore using regular backups and a tested restore path is the lowest ongoing DR cost that still meets a building-permit system’s one-hour RPO and four-hour RTO. The strategy works because those objectives allow hours—not seconds—of recovery, so the city can accept cold recovery from Amazon S3-backed snapshots, AWS Backup vaults, or equivalent restore procedures rather than paying for continuously running duplicate capacity. When RPO is one hour, backup frequency and retention must be engineered accordingly; when RTO is four hours, the restore runbook, AMI/templates, and dependency bring-up must be practiced until they fit the window. Cost stays low because steady-state DR spend is mostly storage and testing, not full twin fleets.
Active-active multi-Region with continuous dual writes fails by concept for this objective set because it optimizes for near-zero RTO and continuous multi-Region serving at the highest ongoing cost, which the question explicitly wants to avoid. Warm standby with a full-scale always-on duplicate fleet fails because warm standby (especially at full scale) burns continuous compute and data-path cost beyond what a four-hour RTO requires. Pilot light described as a continuously running full application stack matching production capacity fails because that misstates pilot light—true pilot light keeps a minimal core, not full production capacity—and the full-capacity always-on posture is far costlier than backup/restore for these targets.
Exam caveat: backup/restore only meets RPO/RTO if restore tests are real; untested backups commonly miss the four-hour window when DNS, secrets, and data restores are sequenced for the first time. Operational check: schedule monthly timed restores of the permit database and app templates into an isolated account, record actual RTO, and adjust backup frequency so worst-case data loss stays within one hour.