SY0-701 Security Program Management and Oversight Practice Question
A records manager is preparing to delete old HR emails next week under the retention schedule. Legal notifies the team that those messages may be needed for an active investigation. What should the records manager do first?
⚠ Common exam trap
Candidates often think moving emails to a shared folder is a safe preservation step, but it actually breaks the formal legal hold process and can compromise metadata and chain of custody, which is why the correct first action is to suspend deletion via a legal hold.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the emails on legal hold and suspend normal deletion for those records.
When legal notifies that emails may be needed for an active investigation, the records manager must immediately suspend normal deletion and place a legal hold on those records. This preserves the data in its original state, preventing spoliation and ensuring compliance with e-discovery obligations. Deleting or moving the emails could destroy metadata or chain of custody, violating legal hold requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the emails on schedule and archive only the subject lines.
Why it's wrong here
Deleting the emails on schedule—even while archiving only subject lines—likely constitutes spoliation of evidence, because the body, attachments, and metadata (e.g., timestamps, senders/recipients) that could be critical to an investigation would be destroyed. A legal hold requires preserving the complete record in its original form, not merely a fragment like the subject line. The retention schedule must be suspended, not executed, once litigation or an audit is anticipated.
- ✓
Place the emails on legal hold and suspend normal deletion for those records.
Why this is correct
A legal hold is the correct action when records might be needed for an investigation, audit, or litigation. It overrides the normal retention schedule and requires the organization to preserve relevant data until legal or compliance staff releases the hold. This protects evidence integrity and avoids accidental destruction of records that could be important to the case.
- ✗
Move the emails to a shared folder so legal can review them later.
Why it's wrong here
Simply moving emails to a shared folder does not implement a legal hold; it leaves the emails subject to the organization's normal retention and deletion policies, and the move could corrupt metadata or break the chain of custody. Without an explicit hold notice and suspension of deletion jobs, the emails remain at risk of being purged. Also, placing HR data in a shared folder exposes sensitive information beyond the need-to-know legal team, escalating privacy risk without any preservation guarantee.
- ✗
Compress the emails into an encrypted file and continue with deletion.
Why it's wrong here
Compressing emails into an encrypted file and then deleting the originals is dangerous because encryption protects confidentiality, not integrity or availability for legal proceedings. The legal hold compels the organization to suspend deletion of the original records; creating an encrypted copy does not satisfy that obligation, and the deletion itself is the very act prohibited. Moreover, if the encryption key is lost or the archive is inaccessible, the data may become effectively unusable for e-discovery, resulting in severe sanctions.
Go deeper
Related to this question
Learn chapter
Compliance and Regulatory Frameworks
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.