CCSP Legal, Risk, and Compliance Practice Question
A cloud customer is subject to an eDiscovery request and stores business records in a cloud object storage service. The legal team needs to preserve potentially relevant data and prevent it from being altered or deleted while the matter is active. Which cloud capability should the customer configure to meet this obligation?
⚠ Common exam trap
Many candidates confuse backup or replication features, which aid recovery, with immutability controls that legally prevent deletion or modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an object lock with a retention mode and legal hold to prevent deletion or overwrite for the required period.
A legal hold requires that potentially relevant data be preserved and protected from alteration or deletion. Object lock, especially in compliance mode, enforces immutability for a defined retention period, and a legal hold flag prevents deletion regardless of retention expiry. These controls give the customer a defensible preservation mechanism that survives administrative actions and supports eDiscovery obligations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable versioning on the bucket so previous object versions remain available after overwrite or deletion.
Why it's wrong here
Versioning retains prior object versions, but it does not prevent a user with sufficient permissions from deleting the current version or from deleting all versions if lifecycle rules or permissions allow it. It supports recovery, but it does not provide the immutability or retention enforcement required by a legal hold.
- ✗
Enable cross-region replication so a secondary copy exists in another region if the primary copy is deleted.
Why it's wrong here
Cross-region replication improves durability and availability, but the replicated copy is still subject to deletion if the source is deleted, depending on replication configuration. It does not create an immutable record and therefore does not satisfy the legal preservation obligation on its own.
- ✓
Apply an object lock with a retention mode and legal hold to prevent deletion or overwrite for the required period.
Why this is correct
Object lock provides write-once-read-many (WORM) protection and, in governance or compliance mode, prevents objects from being deleted or overwritten until the retention period expires. A legal hold can also be applied independently to prevent deletion. This directly satisfies the duty to preserve data during active litigation.
- ✗
Configure a lifecycle policy that transitions objects to cold storage after 30 days to reduce cost.
Why it's wrong here
Lifecycle transitions change the storage class of objects but do not prevent deletion or modification. In fact, lifecycle rules can be configured to expire objects, which would work against a legal hold. This option addresses cost optimization, not preservation or immutability.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.