The answer is the cost of maintaining long-term storage for large volumes of data, along with reconciling conflicting statutory retention periods and ensuring compliance with the strictest applicable law. This is correct because a data retention policy across multiple jurisdictions must navigate varying legal requirements—such as GDPR’s principle of storage limitation versus HIPAA’s six-year minimum—where the cost of storing data longer than necessary can conflict with the need to meet the highest retention mandate to avoid penalties. On the CISSP exam, this tests your grasp of legal, regulatory, and compliance domains, often appearing in scenario-based questions where a global organization must balance operational costs against conflicting retention laws. A common trap is focusing only on the shortest retention period to save money, ignoring that a longer period in another jurisdiction must take precedence. Memory tip: think “longest law, lowest cost conflict”—the strictest retention period wins, but storage costs can force a trade-off.
CISSP Asset Security Practice Question
This CISSP practice question tests your understanding of asset security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are key considerations when implementing a data retention policy for an organization subject to multiple legal jurisdictions?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Varying statutory retention periods across jurisdictions
Option A is correct because different legal jurisdictions impose distinct statutory retention periods for various data types (e.g., GDPR requires retention no longer than necessary, while HIPAA mandates 6 years for medical records). A data retention policy must account for these varying minimums to ensure compliance across all applicable laws. Failing to reconcile conflicting periods can lead to legal penalties or data deletion before a jurisdiction’s requirement is met.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Varying statutory retention periods across jurisdictions
Why this is correct
Different countries have different laws, must comply with the longest.
Related concept
Read the scenario before looking for a memorised answer.
✓
Potential litigation holds that require preserving data beyond normal retention
Why this is correct
Legal holds override standard retention schedules.
Related concept
Read the scenario before looking for a memorised answer.
✓
The cost of maintaining long-term storage for large volumes of data
Why this is correct
Cost is a practical consideration affecting retention feasibility.
Related concept
Read the scenario before looking for a memorised answer.
✗
The organization's ability to delete data after the minimum retention period
Why it's wrong here
Legal holds may prevent deletion; cannot always delete after minimum.
✗
The data owner's personal preference for deletion timelines
Why it's wrong here
Retention decisions are based on law and business need, not personal preference.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse operational convenience (like cost of storage) with a core legal consideration, or they mistakenly think a data owner’s preference is a valid input for a compliance-driven policy, when in fact only statutory and regulatory requirements are primary.
Detailed technical explanation
How to think about this question
Under the hood, data retention policies often rely on automated lifecycle management tools (e.g., AWS S3 Lifecycle Policies or Microsoft 365 Retention Labels) that enforce retention periods based on metadata tags. A subtle behavior is that litigation holds (legal holds) override automated deletion rules—systems must support preservation-in-place (e.g., using Litigation Hold in Exchange Online) to prevent purging even after the retention period expires. In a real-world scenario, a multinational company might face conflicting retention periods for employee records (e.g., 3 years in the EU vs. 5 years in the US), requiring a policy that applies the longest period to avoid non-compliance.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Asset Security — This question tests Asset Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Varying statutory retention periods across jurisdictions — Option A is correct because different legal jurisdictions impose distinct statutory retention periods for various data types (e.g., GDPR requires retention no longer than necessary, while HIPAA mandates 6 years for medical records). A data retention policy must account for these varying minimums to ensure compliance across all applicable laws. Failing to reconcile conflicting periods can lead to legal penalties or data deletion before a jurisdiction’s requirement is met.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.