SSCP Security Operations and Administration Practice Question
A security administrator at a financial services firm is reviewing the organization's data retention practices. The legal team has mandated that certain transaction records be kept for exactly seven years and then destroyed. The administrator must ensure records are deleted automatically after seven years. Which of the following should be implemented to enforce this requirement?
⚠ Common exam trap
Many exam-takers confuse data protection controls like classification or DLP with lifecycle management controls that actually enforce retention and destruction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A retention policy with automated deletion after the seven-year period
A retention policy is the formal control that specifies how long records must be kept and triggers their destruction when the period ends. It aligns legal requirements with operational procedures and can be automated. Classification, backups, and DLP address different concerns and do not enforce time-based deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A data loss prevention (DLP) solution that blocks exfiltration of transaction records
Why it's wrong here
DLP prevents unauthorized transfer of data, but it does not manage lifecycle or deletion. It cannot enforce a seven-year retention limit. While valuable for confidentiality, DLP leaves records in place indefinitely, so it fails to meet the legal requirement for timely destruction.
- ✗
A backup schedule that archives transaction records every quarter to tape
Why it's wrong here
Backups are for recovery, not retention enforcement. Archiving to tape may keep data longer than required and does not automatically delete records at seven years. In fact, backups could preserve data beyond the mandated period, increasing legal and storage risks rather than satisfying the deletion requirement.
- ✗
A data classification scheme that labels transaction records as confidential
Why it's wrong here
Classification labels help determine handling and protection requirements, but they do not enforce a time-based deletion. Without a retention policy, classified records could remain indefinitely, violating the legal mandate. Classification is a supporting control, not the mechanism that automates destruction after seven years.
- ✓
A retention policy with automated deletion after the seven-year period
Why this is correct
A retention policy defines how long data must be kept and automates its destruction when the period expires. This directly enforces the legal mandate without relying on manual intervention, ensuring records are deleted exactly at seven years and reducing the risk of non-compliance or accidental over-retention.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.