CCSP - Cloud Data Security - Section 2.7

Plan and implement data retention, deletion, and archiving policies.

Data retention policies, procedures and mechanisms for secure deletion including crypto-shredding, archiving procedures, and legal hold.

data retention policycrypto-shreddingsecure deletionlegal holdarchiving procedures

Practice question for this objective

Free sampleCloud Data Securitymedium

A financial-services company keeps transaction logs classified as regulated records in object storage on a public IaaS provider. A retention policy requires the logs to be kept for seven years and then deleted. A lifecycle rule is configured to move objects to a cheaper archive tier after 90 days and to delete them after seven years. Before the first objects reach expiry, regulators open an investigation and the company's counsel issues a legal hold over the affected transaction logs. What must the company do first?

  • ASuspend or override the automated expiry so the objects under legal hold are not deleted when their seven-year lifecycle date arrives. Correct
  • BAllow the lifecycle rule to run as configured, since a documented retention policy provides a defensible basis for disposal.
  • CImmediately restore every held object from the archive tier back to the standard tier so investigators can read it faster.
  • DExport the held logs to an on-premises system and let the cloud copies expire on schedule.
A legal hold overrides the normal retention and deletion schedule, so automated expiry must be suspended for the affected data before anything else. Legal holds exist precisely to interrupt routine disposal; the risk is that a time-based lifecycle rule silently destroys evidence, so preservation by pausing expiry takes priority over access or relocation decisions.

Why A is correct: A legal hold supersedes the routine retention schedule, so the immediate priority is preventing the lifecycle rule from deleting evidence when it reaches expiry.

Why B is wrong: Routine disposal is defensible only in the absence of a hold; deleting data known to be subject to an investigation risks spoliation regardless of the policy.

Why C is wrong: Faster access may help later, but it does nothing to stop the scheduled deletion, which is the actual threat to the evidence and the first thing to address.

Why D is wrong: Moving a copy off the platform is tempting but breaks chain of custody and still permits deletion of the originals, which a hold requires be preserved in place.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Data Security objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.