Disaster Recovery Strategy for EHR with RTO/RPO Constraints
A large healthcare provider's primary electronic health record (EHR) application runs on Compute Engine instances with a Cloud SQL for PostgreSQL database, all located in the us-west1 region. A new regulatory mandate requires you to implement and document a business continuity plan (BCP). This plan must ensure that the EHR application can be fully recovered and operational in a different geographical region with a recovery time objective (RTO) of two hours and a recovery point objective (RPO) of 15 minutes. You need to design a disaster recovery strategy that meets these strict BCP requirements. What should you do?
Community Insight
The core concept tested is balancing Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The common trap is selecting manual snapshot restoration which fails RTO, or active-active architectures that may be overkill or misconfigured for the specific constraints.
This question addresses designing a disaster recovery strategy for a healthcare application requiring strict RTO and RPO compliance. It establishes that active-passive replication is the correct approach to meet the specified availability targets.
Many learners choose Option C because daily snapshots seem like a robust backup method. However, this approach involves manual intervention and long restore times, failing the 2-hour RTO requirement completely.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is the correct answer because it implements an active-passive (or potentially active-active depending on interpretation, but clearly automated failover) architecture using Managed Instance Groups (MIGs) and Cloud SQL cross-region replicas. The global HTTP(S) Load Balancer provides automatic traffic routing based on health checks. Cloud SQL cross-region synchronous or asynchronous replication ensures data durability close to the RPO of 15 minutes (depending on configuration, async can drift, but in exam contexts, 'cross-region replica' implies near-real-time sync capability compared to snapshots). The key is automation: failover happens automatically upon detection of an outage, minimizing downtime and meeting the 2-hour RTO.Why the Other Options Are Wrong
Option B suggests using Terraform to configure during disaster. This is a 'cold' site approach; building infrastructure from scratch via IaC during an outage takes hours to days, violating the 2-hour RTO. Option C relies on manual restoration from daily snapshots. Restoring VMs and databases manually is slow and prone to error, easily exceeding the 2-hour RTO. Also, daily snapshots have a potential data loss window up to 24 hours, violating the 15-minute RPO. Option D relies solely on regional SLA, which does not constitute a disaster recovery plan for a different geographical region as required by the mandate.Community Comment Notes
Community consensus strongly favors Option A. One user noted that 'Failover is automated or very fast,' highlighting the importance of automation in meeting RTO. Another user pointed out that while some might argue read replicas aren't backups, in the context of DR for RPO/RTO, they are the standard mechanism for continuous data protection. A dissenting voice mentioned options teach bad practices but conceded A is the least bad, acknowledging the limitations of real-world perfection versus exam constraints.Exam Strategy
When designing DR solutions, always map the requirements directly to technical features. RTO < few hours usually requires automated failover (Load Balancers + MIGs). RPO < few minutes requires continuous replication (Cross-region replicas). Avoid manual processes (Snapshots/IaC on-demand) for low RTO/RPO requirements.
Frequently Asked Questions
Why is Cloud SQL cross-region replica better than snapshots for RPO?
Replicas provide near-continuous data synchronization, keeping data loss within minutes (15 min RPO). Snapshots are point-in-time and can lose up to a day's worth of data if taken daily.
Does the global load balancer support TCP/UDP for non-HTTP apps?
Yes, Google Cloud supports Global External TCP/UDP Load Balancing. The question specifies HTTP(S), but the principle of global health-check-based failover applies similarly to other protocols.
Related Analysis
Practice All PCA Questions
Access 81 questions with complete answers and detailed explanations.
View Full PCA Practice Test →