CAS-001 · Question #172
A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned. The CIO's laptop, cell phone and PC were all wiped of data per company policy. A month…
The correct answer is D. Restore the CIO's email from an email server backup and provide whatever is available up to the. A legal subpoena is a court order that supersedes internal corporate data retention policies. The company is legally obligated to comply and produce whatever evidence it has. The correct response is to restore from email server backups and provide whatever emails are available…
Question
A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned. The CIO's laptop, cell phone and PC were all wiped of data per company policy. A month later, prosecutors in litigation with Company A suspect the CIO knew about the data breach long before it was discovered and have issued a subpoena requesting all the CIO's email from the last 12 months. The corporate retention policy recommends keeping data for no longer than 90 days. Which of the following should occur?
Options
- ARestore the CIO's email from an email server backup and provide the last 90 days from the date
- BInform the litigators that the CIOs information has been deleted as per corporate policy.
- CRestore the CIO's email from an email server backup and provide the last 90 days from the date
- DRestore the CIO's email from an email server backup and provide whatever is available up to the
How the community answered
(43 responses)- A7% (3)
- B12% (5)
- C21% (9)
- D60% (26)
Explanation
A legal subpoena is a court order that supersedes internal corporate data retention policies. The company is legally obligated to comply and produce whatever evidence it has. The correct response is to restore from email server backups and provide whatever emails are available - which may be less than the 12 months requested if backups only go back 90 days. Refusing to provide data (Option B) when server backups may still exist could constitute obstruction of justice or spoliation of evidence. Options A and C are likely identical in phrasing and incorrect because they restrict the response to only 90 days from a specific date, whereas the legal obligation is to produce everything that exists. Option D correctly captures that you provide whatever is available, acknowledging the backup retention limits without artificially restricting the response.
Topics
Community Discussion
No community discussion yet for this question.