SY0-701 Security Program Management and Oversight Practice Question
Exhibit
Records schedule excerpt: - Incident investigation emails: retain 2 years, then delete - HR complaint records: retain 5 years, then delete Legal notice received today: "Preserve all messages, chat transcripts, attachments, and ticket notes related to case HR-2024-118 until further notice. Do not delete, alter, or auto-archive any related records." System status: - Auto-deletion job for the affected mailbox will run tonight at 23:00
Based on the exhibit, what should the records manager do next?
⚠ Common exam trap
Watch out — candidates often assume retention schedules are absolute, but legal holds are a higher-priority legal obligation that overrides standard data lifecycle policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend deletion and preserve all related records until the legal hold is formally lifted.
When a legal hold is in effect, it overrides any standard retention or deletion policies. The records manager must suspend all deletion activities and preserve all related records until the legal hold is formally lifted, as failure to do so could result in spoliation of evidence and legal penalties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the records on schedule because the retention period is still the primary rule.
Why it's wrong here
The retention schedule is the baseline for normal operations, but when a legal hold is issued, it imposes a preservation obligation that suspends any scheduled disposition. The records manager must recognize that a legal hold has higher legal authority than routine retention rules. Continuing to delete based solely on the retention schedule risks spoliation of evidence, which can lead to severe legal penalties. This option is wrong because it misinterprets the hierarchy between retention schedules and legal holds.
- ✗
Move the records to long-term archive and continue the normal deletion schedule.
Why it's wrong here
Even moving records to a long-term archive, if the normal deletion schedule continues to run, could cause relevant records to be purged. The archive might also apply lifecycle policies that automatically expire or delete data, which would violate the preservation requirement. The legal hold demands that all deletion, alteration, and lifecycle management be suspended for the affected records, not just that they be moved to a supposedly safe location. This option is wrong because it fails to halt the deletion schedule, which is the critical obligation.
- ✗
Print the records, delete the digital copies, and keep the paper copies instead.
Why it's wrong here
This option is fundamentally flawed because printing captures only static content, losing metadata, email headers, timestamps, version history, and other electronic evidence that may be essential for litigation or investigation. Deleting the digital copies after printing destroys the original records and may constitute spoliation, even if paper copies exist. Courts and regulatory bodies require preservation of the original format or a fully forensically sound copy, not a partial representation. Thus, this action is wrong because it destroys digital evidence and fails to preserve the complete record.
- ✓
Suspend deletion and preserve all related records until the legal hold is formally lifted.
Why this is correct
A legal hold takes precedence over the routine retention schedule. Because counsel explicitly instructed the organization to preserve all related communications and prevent deletion or alteration, the records manager must stop auto-deletion and ensure the data remains intact. This supports legal defensibility and audit readiness while avoiding accidental spoliation of evidence.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.