Security Operations and Administration →hardMultiple Choice

SSCP Security Operations and Administration Practice Question

A security administrator is drafting a data handling standard for a retail company that processes payment cards. The standard must state how long transaction records may be retained and how they must be destroyed. Which source should PRIMARILY drive these retention and destruction requirements?

⚠ Common exam trap

The trap here is letting a convenient technical or business factor, such as available storage or analytics value, stand in for the legal and contractual obligations that actually govern retention.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Legal, regulatory, and contractual requirements applicable to payment card data.

Data retention and destruction standards must be anchored in the obligations that apply to the data. For payment card information, those obligations come from laws, the payment card industry standard, and acquiring bank contracts. Operational factors such as storage capacity or analytics desires inform implementation but cannot define the retention period or destruction method.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The storage capacity available in the primary transaction database.
Why it's wrong here
Storage capacity is an operational constraint that may influence archiving strategy, but it must never determine how long regulated data is kept. Retaining data longer than allowed because space exists increases breach exposure, while deleting early to save space can violate audit and legal hold requirements. Capacity is a technical input, not a compliance driver.
✗
The vendor's default configuration settings for the point-of-sale system.
Why it's wrong here
Vendor defaults reflect generic product behavior, not the legal, regulatory, and contractual obligations of this retailer. They may retain data longer than permitted or destroy it before required audit periods end. Defaults are a starting point for configuration, but they cannot serve as the authoritative basis for a retention and destruction standard.
✓
Legal, regulatory, and contractual requirements applicable to payment card data.
Why this is correct
Retention and destruction rules for payment card data flow from laws, industry standards such as the Payment Card Industry Data Security Standard, and contracts with acquiring banks. These obligations define minimum and maximum retention periods and acceptable destruction methods. Basing the standard on them ensures the company can demonstrate compliance and avoid penalties.
✗
The preferences of the marketing department for customer analytics.
Why it's wrong here
Marketing analytics may benefit from longer retention, but business convenience does not override legal and contractual limits on payment card data. Allowing analytics preferences to set retention would likely conflict with data minimization obligations. Marketing needs should be met through de-identified or aggregated data, not by extending retention of regulated records.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SSCP Security Operations and Administration Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question