Disaster Recovery Strategy for EHR with RTO/RPO Constraints

PCA By islever Editorial Last updated

Designing network, storage, and compute resources.

Short answer

A Deploy active managed instance groups across regions with a global load balancer and cross-region Cloud SQL replicas to automate failover and ensure data proximity.

Question

A large healthcare provider's primary electronic health record (EHR) application runs on Compute Engine instances with a Cloud SQL for PostgreSQL database, all located in the us-west1 region. A new regulatory mandate requires you to implement and document a business continuity plan (BCP). This plan must ensure that the EHR application can be fully recovered and operational in a different geographical region with a recovery time objective (RTO) of two hours and a recovery point objective (RPO) of 15 minutes. You need to design a disaster recovery strategy that meets these strict BCP requirements. What should you do?
  1. Deploy active managed instance groups (MIGs) in both us-west1 and us-east1, fronted by a global external HTTP(S) Load Balancer. For the database, use a cross-region read replica in us-east1, and rely on load balancer health checks to automatically fail over all traffic during an outage. Correct Answer
  2. Use Terraform to define the application’s compute infrastructure. During a disaster, configure the Cloud SQL database in us-west1 to use a cross-region read replica in us-east1, build the environment in us-east1, and promote the replica.
  3. Take daily snapshots of the Compute Engine disks and Cloud SQL database. Copy these snapshots to a Cloud Storage bucket in us-east1. During a disaster, manually restore the virtual machines (VMs) and database from the latest snapshots
  4. Deploy a regional MIG in us-west1 for high availability, and rely on the Google Cloud SLA to ensure the region remains online.

Key Takeaways

The core concept tested is balancing Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The common trap is selecting manual snapshot restoration which fails RTO, or active-active architectures that may be overkill or misconfigured for the specific constraints.

This question addresses designing a disaster recovery strategy for a healthcare application requiring strict RTO and RPO compliance. It establishes that active-passive replication is the correct approach to meet the specified availability targets.

Common mistake: Many learners choose Option C because daily snapshots seem like a robust backup method. However, this approach involves manual intervention and long restore times, failing the 2-hour RTO requirement completely.

Expert Analysis

Why the Answer Is Correct

Option A is the correct answer because it implements an active-passive (or potentially active-active depending on interpretation, but clearly automated failover) architecture using Managed Instance Groups (MIGs) and Cloud SQL cross-region replicas. The global HTTP(S) Load Balancer provides automatic traffic routing based on health checks. Cloud SQL cross-region synchronous or asynchronous replication ensures data durability close to the RPO of 15 minutes (depending on configuration, async can drift, but in exam contexts, 'cross-region replica' implies near-real-time sync capability compared to snapshots). The key is automation: failover happens automatically upon detection of an outage, minimizing downtime and meeting the 2-hour RTO.

Why the Other Options Are Wrong

Option B suggests using Terraform to configure during disaster. This is a 'cold' site approach; building infrastructure from scratch via IaC during an outage takes hours to days, violating the 2-hour RTO. Option C relies on manual restoration from daily snapshots. Restoring VMs and databases manually is slow and prone to error, easily exceeding the 2-hour RTO. Also, daily snapshots have a potential data loss window up to 24 hours, violating the 15-minute RPO. Option D relies solely on regional SLA, which does not constitute a disaster recovery plan for a different geographical region as required by the mandate.

Community Comment Notes

Community consensus strongly favors Option A. One user noted that 'Failover is automated or very fast,' highlighting the importance of automation in meeting RTO. Another user pointed out that while some might argue read replicas aren't backups, in the context of DR for RPO/RTO, they are the standard mechanism for continuous data protection. A dissenting voice mentioned options teach bad practices but conceded A is the least bad, acknowledging the limitations of real-world perfection versus exam constraints.

Exam Strategy

When designing DR solutions, always map the requirements directly to technical features. RTO < few hours usually requires automated failover (Load Balancers + MIGs). RPO < few minutes requires continuous replication (Cross-region replicas). Avoid manual processes (Snapshots/IaC on-demand) for low RTO/RPO requirements.

Frequently Asked Questions

Why is Cloud SQL cross-region replica better than snapshots for RPO?

Replicas provide near-continuous data synchronization, keeping data loss within minutes (15 min RPO). Snapshots are point-in-time and can lose up to a day's worth of data if taken daily.

Does the global load balancer support TCP/UDP for non-HTTP apps?

Yes, Google Cloud supports Global External TCP/UDP Load Balancing. The question specifies HTTP(S), but the principle of global health-check-based failover applies similarly to other protocols.

More PCA FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. glb2 👍 3 Answered A
    Only answer A. Failover is automated or very fast Minimal data loss Meets both: ✅ RTO (fast failover) ✅ RPO (replication)
  2. Pime13 👍 2
    100% Agree
  3. hitmax87 👍 1 Answered A
    All options are silly, but the less one is A. Honestly speaking options teach you bad practices, e.g. read replica not equal to backups. It completely does not meet proper Disaster Recover approach.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Multi-Regional vs Regional Cloud Storage for Global Software Downloads

S-grade

Surviving a Zone Outage With SQL Server on GCP

S-grade

Fixing BigQuery connection errors from a Compute Engine VM

S-grade

Moving 75 TB into Cloud Storage with Google-recommended practices

S-grade

Practice All PCA Questions

Access 81 questions with complete answers and detailed explanations.

View Full PCA Practice Test →

← Back to PCA Study Guide