SY0-701 Security Program Management and Oversight Practice Question
A records manager discovers 18-month-old paper onboarding forms stored in a cabinet. The retention schedule says the forms must be destroyed after 12 months unless legal hold applies, and no hold has been issued. What is the best next step?
⚠ Common exam trap
Many candidates choose Option B (scanning) thinking digital preservation is safer, but the question tests the principle that retention schedules mandate destruction—not conversion—and that scanning without secure disposal still leaves the paper intact, violating policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destroy the forms using an approved secure disposal method and document the action.
The retention schedule explicitly requires destruction after 12 months with no legal hold. An approved secure disposal method (e.g., cross-cut shredding or incineration) ensures the sensitive PII on onboarding forms is irrecoverable, and documenting the action provides an audit trail for compliance with data protection regulations like GDPR or HIPAA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the forms indefinitely in case a future audit asks for them.
Why it's wrong here
Keeping the forms indefinitely exceeds the approved records retention schedule and violates data minimization principles. A potential future audit does not constitute a legal hold; only an active litigation or investigation hold can supersede the retention period. Storing outdated PII increases privacy exposure and security liability for no business benefit, and may also conflict with regulatory requirements to destroy personal data after retention expires.
- ✗
Scan the forms into a shared folder and then throw away the paper.
Why it's wrong here
Scanning the forms does not reset or extend the retention schedule, because all copies—paper or digital—remain records subject to the same disposition rules. A shared folder, without strict access controls and encryption, greatly increases the risk of unauthorized disclosure of protected PII. Additionally, electronically stored records must be disposed of by secure deletion, and merely discarding the paper does not eliminate the retention obligation.
- ✓
Destroy the forms using an approved secure disposal method and document the action.
Why this is correct
Once the retention period expires and no legal hold is in force, the correct action is secure destruction using an approved method such as cross-cut shredding, burning, or pulping to prevent reconstruction of PII. Documenting the destruction with a certificate of destruction or equivalent log provides an audit trail that demonstrates compliance with the records schedule. This ensures the information is permanently unrecoverable while satisfying accountability requirements.
- ✗
Return the forms to HR so they can be reused for new hires.
Why it's wrong here
Returning completed onboarding forms to HR for reuse is a misunderstanding: these are filled records containing prior employees' personal and identification data, not blank templates. Reusing them would intermingle new hires' information with old employees' PII, creating identity integrity issues and potential privacy violations. This practice also violates records management and data minimization policies, and does not comply with retention or disposal requirements.
Go deeper
Related to this question
Learn chapter
Compliance and Regulatory Frameworks
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.