SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the reports immediately because the business no longer uses them

  Why it's wrong here

  Deleting the reports immediately without consulting the retention schedule constitutes spoliation—the destruction of evidence potentially relevant to litigation, audits, or regulatory inquiries. Payroll records frequently have statutory retention periods (e.g., under the Fair Labor Standards Act) that apply regardless of current operational use, and premature deletion can trigger fines, legal sanctions, or adverse inference instructions. A compliant disposition process requires documented authorization and verification that no legal or regulatory hold applies before any physical or logical deletion occurs.

• ✓

  Move the reports to an approved archive and retain them for the required period

  Why this is correct

  Moving the reports to an approved archive—implemented with immutable storage, access logging, and role-based permissions—satisfies the governing retention schedule while also preserving the records' authenticity and metadata for any future audit or e-discovery request. This action removes the sensitive payroll data from the unrestricted shared workspace and places it under formal records management controls, ensuring it remains retrievable for the required period. The archive should also recognize any active legal hold and tag the records for automatic, auditable disposition once that period expires without risk of inadvertent loss.

• ✗

  Email the reports to each manager so they can keep their own copy

  Why it's wrong here

  Emailing the reports to individual managers breaks the chain of custody by creating multiple decentralized copies that lack consistent classification, encryption, and access governance. Each inbox becomes an uncontrolled repository, making it impossible to enforce a single retention period or to uniformly respond to legal holds, while also enlarging the attack surface for data exfiltration and violating privacy principles like data minimization. Informal email copies also defeat future disposal obligations because managers may keep or delete them arbitrarily, creating compliance liability under regulations such as GDPR or the Sarbanes-Oxley Act.

• ✗

  Rename the folder so users do not notice it on the shared drive

  Why it's wrong here

  Renaming the folder merely changes its label while leaving the underlying records unclassified, ungoverned, and still physically present on a shared drive with existing permissions. This action does not alter the records' retention status, access controls, or audit trail, and it fails to address legal or regulatory discovery requirements. In practice, renaming can mask the records from compliance tools, increase confusion among authorized users, and inadvertently delay a defensible disposition, which is far worse than leaving the original name visible but properly managed.

Go deeper

Related to this question