200-201 Security Policies and Procedures Practice Question
An organization is required to preserve data that may be relevant to a lawsuit. Which legal process is invoked to prevent destruction of this data?
⚠ Common exam trap
The trap is confusing e-discovery (the overall process) with legal hold (the specific preservation action) — candidates pick e-discovery because it sounds like the legal process, but the question asks what prevents destruction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Legal hold
A legal hold is the process invoked to preserve data that may be relevant to litigation, preventing its destruction or modification. It overrides normal retention and deletion policies, ensuring electronically stored information (ESI) is retained until the hold is released. In Microsoft 365, this is implemented via Litigation Hold or eDiscovery holds on mailboxes and sites.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
E-discovery
Why it's wrong here
E-discovery is the process of identifying, collecting and producing data for litigation; it does not itself impose the preservation duty. The stem asks which process prevents destruction, which is a legal hold. E-discovery would be correct when the task is locating and handing over relevant records to opposing counsel.
- ✓
Legal hold
Why this is correct
Legal hold suspends normal retention and deletion schedules, preserving data that may be relevant to anticipated or active litigation. It satisfies the stem's requirement to prevent destruction of lawsuit-relevant data, unlike spoliation, which describes the improper loss itself. Microsoft Entra ID and Microsoft Purview apply holds to mailboxes, sites and identities.
- ✗
Chain of custody
Why it's wrong here
Chain of custody documents who handled evidence and when, preserving its admissibility; it does not stop deletion. The stem requires a mechanism that suspends destruction, which is a legal hold. Chain of custody is correct when evidence has been seized and its transfer history must be provable in court.
- ✗
Data retention policy
Why it's wrong here
A data retention policy sets scheduled deletion periods for data classes; it governs routine lifecycle, not litigation-driven suspension. The stem needs destruction halted, which a legal hold achieves. A retention policy is correct when defining how long each record type is kept before routine disposal.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.