An administrator initiates an unplanned failover due to a primary AZ outage. What is the worst-case scenario for data loss and which recovery point will be used by default?

During an unplanned failover, the primary site is considered offline and unreachable. The recovery process must rely on the latest data already replicated to the recovery site. The worst-case data loss is determined by the Recovery Point Objective (RPO) defined in the protection policy; for example, a 1-hour RPO means the last replicated snapshot could be up to one hour old. By default, the recovery plan will automatically use the most recent recovery point (snapshot) available at the recovery AZ to minimize data loss.

B. Maximum data loss equals the longest RPO, and the administrator must always manually select a recovery point: The system defaults to using the most recent recovery point; manual selection is an option but not a requirement.
C. Data loss depends only on recovery plan, and the system uses recovery points at the recovery AZ by default: Data loss is a function of the RPO set in the protection policy, not the recovery plan. The recovery plan only orchestrates the failover.
D. Maximum data loss is always zero, and the system uses the most recent recovery point by default: Zero data loss (RPO=0) is only achievable with synchronous replication. This statement is not true for the more common asynchronous or nearsync replication schedules.

1. Nutanix Disaster Recovery Guide v6.8, "Unplanned Failover" section. The guide explains: "An unplanned failover is an emergency operation... The system uses the latest available recovery point of the entities at the recovery AZs to recover the entities."

2. Nutanix Bible, "Nutanix Leap" chapter, by Steven Poitras. The "Recovery Point Objective (RPO)" section defines RPO as the maximum tolerable amount of data loss, which is determined by the replication schedule. The "Failover (Unplanned)" section describes using the latest available snapshot at the DR site.