A financial-services company keeps transaction logs classified as regulated records in object storage on a public IaaS provider. A retention policy requires the logs to be kept for seven years and then deleted. A lifecycle rule is configured to move objects to a cheaper archive tier after 90 days and to delete them after seven years. Before the first objects reach expiry, regulators open an investigation and the company's counsel issues a legal hold over the affected transaction logs. What must the company do first?
- ASuspend or override the automated expiry so the objects under legal hold are not deleted when their seven-year lifecycle date arrives. Correct
- BAllow the lifecycle rule to run as configured, since a documented retention policy provides a defensible basis for disposal.
- CImmediately restore every held object from the archive tier back to the standard tier so investigators can read it faster.
- DExport the held logs to an on-premises system and let the cloud copies expire on schedule.
Why A is correct: A legal hold supersedes the routine retention schedule, so the immediate priority is preventing the lifecycle rule from deleting evidence when it reaches expiry.
Why B is wrong: Routine disposal is defensible only in the absence of a hold; deleting data known to be subject to an investigation risks spoliation regardless of the policy.
Why C is wrong: Faster access may help later, but it does nothing to stop the scheduled deletion, which is the actual threat to the evidence and the first thing to address.
Why D is wrong: Moving a copy off the platform is tempting but breaks chain of custody and still permits deletion of the originals, which a hold requires be preserved in place.