CAS-001 · Question #310
A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all…
The correct answer is C. Provide the 1Tb of files on the network and the 300Mb of email files regardless of age. Once an e-discovery request or legal hold is in effect, all potentially relevant data must be preserved and produced - regardless of whether it exceeds internal policy thresholds. Deleting data after receiving a legal hold constitutes spoliation of evidence, which is illegal…
Question
A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all email data older than 90 days should be eliminated. As there are no technical controls in place, users have been instructed to stick to a storage quota of 500Mb of network storage and 200Mb of email storage. After being presented with an e-discovery request from an opposing legal council, the security administrator discovers that the user in the suit has 1Tb of files and 300Mb of email spanning over two years. Which of the following should the security administrator provide to opposing council?
Options
- ADelete files and email exceeding policy thresholds and turn over the remaining files and email.
- BDelete email over the policy threshold and hand over the remaining emails and all of the files.
- CProvide the 1Tb of files on the network and the 300Mb of email files regardless of age.
- DProvide the first 200Mb of e-mail and the first 500Mb of files as per policy.
How the community answered
(44 responses)- A16% (7)
- B23% (10)
- C55% (24)
- D7% (3)
Explanation
Once an e-discovery request or legal hold is in effect, all potentially relevant data must be preserved and produced - regardless of whether it exceeds internal policy thresholds. Deleting data after receiving a legal hold constitutes spoliation of evidence, which is illegal and can result in severe sanctions, adverse inference instructions, or even criminal liability. Answer C is correct: provide all 1 TB of files and all 300 MB of email regardless of age. Options A and B are both legally dangerous because they involve deleting data after a legal discovery request has been received. Option D is incorrect because it arbitrarily caps production at policy limits rather than complying with the legal obligation to produce everything. The legal hold supersedes internal retention and storage policies.
Topics
Community Discussion
No community discussion yet for this question.