easyMultiple ChoiceObjective-mapped
Data Retention Schedule: The Best Control for Not Retaining Data Longer Than Necessary
An organization wants to ensure that data is not retained longer than necessary. Which of the following is the BEST control to implement?
Quick Answer
The answer is to define and enforce data retention schedules. This is the best control because it directly addresses the requirement by establishing precise timeframes for data deletion or archival, automating lifecycle management through mechanisms like object storage expiration policies or database TTL settings, thereby preventing indefinite data persistence. On the CISA exam, this question tests your understanding of data lifecycle governance and the distinction between preventive controls (schedules) and detective controls (audit logs); a common trap is confusing a retention schedule with a backup policy, which preserves data rather than purges it. Remember the mnemonic “R.A.I.D.”: Retention schedules Automate, Implement, and Delete—ensuring data doesn’t overstay its welcome.
⚠ Common exam trap
A common mix-up: candidates confuse data retention (how long data is kept) with data protection mechanisms like encryption or access control, or they mistakenly think backup retention policies are sufficient for primary data lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define and enforce data retention schedules
Defining and enforcing data retention schedules directly addresses the requirement to not retain data longer than necessary by specifying precise timeframes for data deletion or archival. This control ensures compliance with legal, regulatory, and business needs by automating the lifecycle management of data, such as through expiration policies in object storage (e.g., S3 Lifecycle rules) or database TTL (time-to-live) settings. Without such schedules, data may persist indefinitely, increasing storage costs and regulatory risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all data at rest
Why it's wrong here
Encryption does not enforce retention.
- ✗
Implement a backup retention policy
Why it's wrong here
Backup retention is part of data retention.
- ✗
Use role-based access controls
Why it's wrong here
Access controls do not enforce deletion.
- ✓
Define and enforce data retention schedules
Why this is correct
Retention schedules ensure data is deleted when no longer needed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization is implementing a data retention policy for personally identifiable information (PII) to comply with GDPR. Which of the following is the MOST appropriate approach?
hard- A.Delete PII as soon as it is collected
- B.Anonymize PII after a fixed period and retain indefinitely
- C.Retain PII indefinitely for historical analysis
- ✓ D.Define retention periods based on legal and business requirements and securely delete after
Why D: GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.