easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A regional bank is migrating its customer data to…
A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?
⚠ Common exam trap
ISC2 often tests the misconception that an SLA can override technical limitations or regulatory obligations, but the trap here is that candidates may choose D without realizing that SLAs cannot guarantee deletion within 30 days for archived data due to inherent storage architecture constraints, and the bank must instead implement a process to handle expedited deletion requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a process to request immediate deletion from the provider and verify completion within 30 days.
The bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store all customer data on-premises and only use the cloud for non-sensitive data.
Why it's wrong here
This avoids the issue but restricts cloud usage unnecessarily and may not be aligned with business strategy.
- ✗
Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.
Why it's wrong here
Shifting liability does not achieve actual deletion within the regulatory timeline; the bank remains responsible.
- ✓
Implement a process to request immediate deletion from the provider and verify completion within 30 days.
Why this is correct
This directly ensures compliance with the 30-day GDPR requirement through active management and verification.
- ✗
Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.
Why it's wrong here
The provider may not be able to meet this SLA due to technical limitations; negotiation alone does not guarantee capability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.