How Do You Design a Disaster Recovery Plan?
Learn how to design a disaster recovery plan using RTO, RPO, and DR strategy tiers from backup-restore to active-active.
Expected Interview Answer
A disaster recovery plan is designed by first setting two business-driven targets — Recovery Time Objective (RTO, how fast you must be back up) and Recovery Point Objective (RPO, how much data loss is acceptable) — and then choosing an architecture strategy (backup-restore, pilot light, warm standby, or multi-site active-active) that meets those targets at an acceptable cost.
RTO and RPO are set per workload based on actual business impact, not chosen arbitrarily: a payments ledger might need near-zero RPO and an RTO of minutes, while an internal reporting tool might tolerate hours of both. From there, four common DR strategies trade cost against recovery speed: backup-restore (cheapest, slowest — restore from backups in a new environment, hours to days), pilot light (minimal core infrastructure always running in a standby region, scaled up on failover, tens of minutes), warm standby (a scaled-down but fully functional replica always running, minutes), and multi-site active-active (full production capacity live in multiple regions simultaneously, near-zero RTO/RPO, most expensive). A complete plan also documents the failover trigger and decision process, runbooks for executing failover and failback, and — critically — is validated with regular game-day drills, because an untested DR plan is not a real one; many outages are made worse by teams discovering their backups were incomplete or their runbook was outdated only during a real incident.
- Ties recovery investment directly to measurable business impact via RTO/RPO rather than guesswork
- Provides a clear cost/speed trade-off ladder (backup-restore through active-active) to choose from
- Documented runbooks and triggers remove ambiguity and panic during a real incident
- Regular game-day drills catch gaps (stale backups, broken runbooks) before a real disaster does
AI Mentor Explanation
RTO is like how quickly a team must get a replacement player onto the field after an injury — a few minutes for a top league, longer for a casual match. RPO is like how much of the innings' scoring history you are willing to risk losing if the scorebook is damaged, from zero (a duplicate scorer keeping a live backup) to an entire session. A backup-restore strategy is like keeping only a written scorecard you would have to painstakingly reconstruct from; a full active standby is like having a complete second XI already warmed up and ready to walk in immediately. Choosing the right strategy means matching how fast you truly need to recover to how much you are willing to spend keeping backups ready.
Step-by-Step Explanation
Step 1
Set RTO and RPO per workload
Work with business stakeholders to define maximum tolerable downtime (RTO) and data loss (RPO) for each critical system, based on real business impact.
Step 2
Choose a DR strategy tier
Pick backup-restore, pilot light, warm standby, or multi-site active-active based on which tier meets the RTO/RPO at an acceptable cost.
Step 3
Document triggers and runbooks
Write clear failover trigger criteria and step-by-step runbooks for both failover and failback so responders do not improvise during an incident.
Step 4
Run regular game-day drills
Periodically execute real or simulated failovers to validate backups are restorable and runbooks are current, fixing gaps before a real disaster exposes them.
What Interviewer Expects
- Defines RTO and RPO correctly and distinguishes them clearly
- Names and compares the standard DR strategy tiers (backup-restore, pilot light, warm standby, multi-site active-active)
- Connects strategy choice to cost versus recovery-speed trade-offs
- Emphasizes testing the plan via game-day drills, not just documenting it
Common Mistakes
- Confusing RTO (time to recover) with RPO (data loss tolerance)
- Proposing the most expensive tier (active-active) for every workload regardless of actual business impact
- Writing a DR plan on paper but never testing it with a real or simulated failover
- Forgetting failback (returning to the primary region) as part of the plan, not just failover
Best Answer (HR Friendly)
“A disaster recovery plan starts by asking two questions for each system: how fast do we need to be back up, and how much data can we afford to lose. Based on those answers we pick an approach, from cheap nightly backups all the way up to a fully live backup environment running at all times, and then we regularly practice actually failing over to it so we know it really works when a real outage happens.”
Code Example
workloads:
payments-ledger:
rto: "5m"
rpo: "0s"
strategy: multi-site-active-active
regions: [us-east-1, eu-west-1]
order-service:
rto: "15m"
rpo: "1m"
strategy: warm-standby
standbyRegion: us-west-2
replicationLag: "<1m"
internal-reporting:
rto: "24h"
rpo: "24h"
strategy: backup-restore
backupSchedule: "daily"
backupRetention: "30d"
drDrills:
frequency: quarterly
scope: [payments-ledger, order-service]
validates:
- "backups are restorable within RTO"
- "runbook steps are current and executable"Follow-up Questions
- How would you choose between pilot light and warm standby for a mid-sized service?
- What does a failback process need to handle that failover does not?
- How do you validate that your backups actually meet the RPO you have committed to?
- What is the difference between a game-day drill and a chaos engineering experiment?
MCQ Practice
1. What does RPO (Recovery Point Objective) measure?
RPO defines the maximum acceptable amount of data loss, expressed as a time window (e.g. "up to 1 minute of data may be lost").
2. Which DR strategy typically offers the fastest recovery but at the highest cost?
Multi-site active-active runs full production capacity live in multiple regions simultaneously, giving near-zero RTO/RPO at the highest infrastructure cost.
3. Why are game-day drills considered essential to a disaster recovery plan?
An untested DR plan often has stale backups or outdated runbooks; game-day drills surface those gaps safely instead of during a real incident.
Flash Cards
RTO? — Recovery Time Objective — the maximum acceptable time to restore service after a disaster.
RPO? — Recovery Point Objective — the maximum acceptable amount of data loss, measured as a time window.
Cheapest DR strategy? — Backup-restore — restore from backups into a new environment; slowest recovery.
Fastest DR strategy? — Multi-site active-active — full capacity running live in multiple regions simultaneously.