mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A financial services company uses a cloud-based…
A financial services company uses a cloud-based logging service for audit trails. A regulatory investigation is initiated, and the company is required to preserve all logs from the past 18 months. The cloud provider's default retention policy is 12 months, and logs older than that are automatically deleted. The company did not configure custom retention. What is the most appropriate action to ensure compliance?
⚠ Common exam trap
ISC2 often tests the misconception that exporting logs locally is sufficient for compliance, but the trap is that this fails to preserve logs already deleted and does not meet the requirement for ongoing preservation, whereas a legal hold is the designed mechanism for regulatory holds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request that the provider place a legal hold on all logs and verify implementation.
A legal hold (or litigation hold) is a cloud provider feature that overrides the default retention policy to preserve data indefinitely or for a specified period, preventing automated deletion. This ensures compliance with regulatory requirements without relying on manual exports or backups, and the company must verify implementation through provider tools or APIs to confirm the hold is active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the data loss and explain to regulators that the provider has a limited retention policy.
Why it's wrong here
Accepting data loss violates the legal preservation requirement and could lead to penalties.
- ✗
Export all available logs and store them locally immediately.
Why it's wrong here
This only captures current logs; older logs may already be deleted and cannot be recovered.
- ✓
Request that the provider place a legal hold on all logs and verify implementation.
Why this is correct
A legal hold overrides retention policies and ensures preservation; verification confirms compliance.
- ✗
Rely on the provider's backup policy, which may retain data for up to 24 months.
Why it's wrong here
Backup retention is not guaranteed and may not cover all logs; reliance on it is risky.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.