CCSP Legal, Risk, and Compliance Practice Question
A cloud customer requires that its data stored by a provider be irretrievably destroyed after contract termination, even if the provider uses backup tapes and replicated storage. Which contractual and technical provision best supports this requirement?
⚠ Common exam trap
Test-takers frequently confuse data retention limits or audit rights with actual secure deletion obligations, which require explicit sanitization and certification clauses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A clause requiring the provider to sanitize or crypto-shred all customer data, including backups and replicas, and to provide a certificate of destruction upon termination.
Irretrievable destruction requires more than retention limits or audit rights; it demands a contractual obligation to sanitize or crypto-shred all copies, including backups and replicas, and to certify destruction. Crypto-shredding is effective when data is encrypted and keys can be destroyed. The certificate of destruction provides verifiable evidence that the obligation was met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A right-to-audit clause that allows the customer to inspect the provider's data centers annually.
Why it's wrong here
A right-to-audit clause supports verification of controls but does not by itself ensure destruction of data across backups and replicas. It provides inspection rights, not deletion obligations or technical erasure methods. Without a specific deletion and certification clause, the customer could audit and still find residual data in backups, failing the irretrievable destruction requirement.
- ✓
A clause requiring the provider to sanitize or crypto-shred all customer data, including backups and replicas, and to provide a certificate of destruction upon termination.
Why this is correct
This directly addresses irretrievable destruction by requiring sanitization or crypto-shredding across all copies, including backups and replicas, and by demanding a certificate of destruction. Crypto-shredding destroys the encryption keys, rendering data unreadable. The certificate provides evidence. This combination is the standard contractual and technical mechanism to meet secure deletion requirements in cloud contracts.
- ✗
A service level agreement that guarantees 99.99% data durability during the contract term.
Why it's wrong here
Durability guarantees address data loss prevention during the contract, not destruction after termination. High durability means data is replicated and retained, which actually complicates deletion because multiple copies exist. A durability SLA does not obligate the provider to erase data or certify its destruction, so it fails to satisfy the requirement for irretrievable post-termination destruction.
- ✗
A data retention schedule that specifies how long the provider may keep customer data before automatic deletion.
Why it's wrong here
A retention schedule defines how long data is kept, not how it is destroyed. It may reduce the volume of retained data, but it does not guarantee secure erasure from backups, replicas, or archived media. The scenario demands irretrievable destruction after termination, which requires explicit deletion, sanitization, and certification provisions beyond a retention timeline.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.