RPO, RTO & BC Strategy
Recovery objectives · HA vs DR vs Backup · Picking the right tool
Practice questions for this topic →
Core terms (Well-Architected definitions)
| Term | Meaning | Example wording |
|---|---|---|
| RPO (recovery point objective) | The maximum acceptable duration of data loss | No more than 5 seconds of data loss |
| RTO (recovery time objective) | The maximum acceptable time an application can be unavailable after an incident | Back online within 30 seconds |
| SLO / SLA | SLO: a measurable target for the workload. SLA: a contractual agreement, with financial consequences if missed | 99.9% availability |
| MTTR / MTBF | Mean time to recover after a failure / mean time between failures | — |
| High availability (HA) | Survive failures inside a region (zones, replicas) | If a datacenter or zone fails… |
| Disaster recovery (DR) | Survive loss of a region | If the region becomes unavailable… |
| Backup | Recover from deletion, corruption, ransomware | Restore the data as it was 3 days ago |
Pick the tool
| Requirement | Tool |
|---|---|
| VMs must fail over to another region or zone | Azure Site Recovery (continuous replication, failover, failback) |
| Restore deleted or corrupted data | Azure Backup (data protection: backup and restore) |
| SQL DB regional failover, unchanged connection string | Failover group |
| SQL DB: undo a bad update from 2 hours ago | Point-in-time restore |
| Keep database backups 7–10 years | Long-term retention |
| Storage readable during a regional outage | RA-GRS / RA-GZRS |
| Cosmos DB restore to any second in the last 30 days | Continuous backup (30-day tier) |
Replication (ASR, geo-replication, GRS) copies corruption and deletes too: it is not a backup. Microsoft says Azure Backup focuses on data protection; for DR and failover orchestration use Azure Site Recovery.
Facts to know
- Azure Backup protects VMs, disks, SQL Server and SAP HANA in VMs, PostgreSQL and MySQL flexible servers, Azure Files, blobs, Data Lake Storage, AKS and on-premises files, folders and servers (MARS agent, MABS), with policy-based schedules and retention.
- Site Recovery covers zonal failures to regional outages for Azure VMs, plus on-premises VMs, Azure Stack VMs and physical servers; replication doesn't intercept application data. Assess dependencies, recovery requirements, network connectivity and target capacity before enabling replication. A High Churn option handles up to 100 MB/s of data churn per VM (some configurations up to 500 MB/s).
- Availability zones: separated groups of datacenters in a region with independent power, cooling and networking. A zone-redundant resource is replicated across zones by the service; a zonal resource is pinned to one. A resource is resilient to a zone failure as long as it uses two or more zones.
Exam Tips
Tick each tip once you can answer it without looking.
“Replication to another region is enough; no backups needed?” → False: replication copies deletes/corruption; you still need backups.
“RPO of seconds and RTO of seconds for SQL in-region” → Zone-redundant Business Critical (synchronous replicas).
“Requirement mentions a datacenter failure” → Availability zones (HA). Trap: Geo/region features answer a different requirement.
“Requirement mentions a regional outage” → Cross-region DR: ASR, failover groups, GZRS, multi-region Cosmos.
“Lowest cost option that still meets the stated RPO/RTO” → Pick the cheapest option that meets every requirement; don't over-engineer.
“Prove DR works without affecting production” → ASR test failover / storage planned failover / Backup cross region restore drill.
“SLO versus SLA” → SLO is a measurable target; SLA is a contract with financial consequences. Trap: SLI is the measurement; MTTR and MTBF describe recovery and failure frequency.
“RTO versus RPO wording” → RTO: maximum acceptable unavailability. RPO: maximum acceptable data-loss duration. Trap: Mix-ups between them are a common trap.
“Backup service versus DR service” → Azure Backup protects and restores data; Azure Site Recovery orchestrates replication and failover. Trap: Replication isn't backup.
“Zone-redundant versus zonal resources” → Zone-redundant: replicated across zones by the service. Zonal: pinned to one zone. Trap: Resilient to a zone failure only if two or more zones are used.