Calculate RTO, RPO and what redundancy actually buys

short · 40 min · Objective 3.3

Task

Work out the recovery objectives for four scenarios, compute the availability that different redundancy designs deliver, and convert "five nines" into an amount of downtime you can picture. These are arithmetic questions and they are reliably on the exam.

Steps

  1. Define the two terms precisely in your own words before going further. RPO is how much data you can afford to lose, measured backwards from the failure. RTO is how long you can afford to be down, measured forwards. They are independent and people routinely conflate them.
  2. For each scenario, state the RPO and RTO implied: a bank's transaction ledger; an office file server; a public marketing website; a developer's build machine. Justify each in one sentence.
  3. For the file server with a nightly backup at 02:00, state the worst-case data loss if it fails at 17:00. That number is the RPO your current design actually delivers, whatever the policy document says.
  4. Convert the availability tiers into downtime per year: 99%, 99.9%, 99.99%, 99.999%. Then state what each costs in downtime per month and per week, because that is the unit people actually feel.
  5. Calculate what redundancy buys. If one component is 99% available, what is the availability of two in parallel? Of three? And what happens if they share a single power feed?

Verify

python3 -c "
for nines in (99, 99.9, 99.99, 99.999):
    down = (100 - nines) / 100 * 365 * 24 * 60
    print(f'{nines:>7}%  {down:9.1f} min/year  {down/12:7.1f} min/month  {down/52:6.1f} min/week')
print()
a = 0.99
for n in (1, 2, 3):
    print(f'{n} parallel component(s) at 99%: {(1 - (1-a)**n)*100:.4f}% available')
print()
print('shared power feed: the feed becomes the single point of failure and the parallelism buys nothing')
"

99.999% must come out at about 5.3 minutes a year — the number behind "five nines". Two components in parallel reach 99.99%, and three reach 99.9999%. If your scenario answers gave the marketing website the same RTO as the bank ledger, reconsider: recovery objectives are a cost decision, not a quality one.

Notes

The step-3 answer is the one worth carrying: a nightly backup gives you an RPO of up to 24 hours, not "one day's worth on average". A failure at 17:00 with a 02:00 backup loses fifteen hours of work. If the business cannot accept that, the answer is more frequent backups or replication, and no amount of faster restore helps — that is RTO, a different number.

The shared-power point is the one exam scenarios love. Two firewalls in a high-availability pair, both plugged into the same PDU, deliver the availability of that PDU. Redundancy only helps against failures that are independent, and finding the shared dependency is the skill.

The vocabulary to keep straight: MTBF is mean time between failures, a property of the component; MTTR is mean time to repair, a property of your organisation. Availability is derived from both, and MTTR is the one you can actually improve.