nerdexam
CompTIA

CAS-002 · Question #251

A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all…

The correct answer is C. Provide the 1Tb of files on the network and the 300Mb of email files regardless of age. Once an e-discovery request is received, a legal hold is triggered that supersedes any existing data retention or deletion policies - destroying data at this point constitutes spoliation of evidence.

Integration of Computing, Communications and Business Disciplines

Question

A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all email data older than 90 days should be eliminated. As there are no technical controls in place, users have been instructed to stick to a storage quota of 500Mb of network storage and 200Mb of email storage. After being presented with an e-discovery request from an opposing legal council, the security administrator discovers that the user in the suit has 1Tb of files and 300Mb of email spanning over two years. Which of the following should the security administrator provide to opposing council?

Options

  • ADelete files and email exceeding policy thresholds and turn over the remaining files and
  • BDelete email over the policy threshold and hand over the remaining emails and all of the
  • CProvide the 1Tb of files on the network and the 300Mb of email files regardless of age.
  • DProvide the first 200Mb of e-mail and the first 500Mb of files as per policy.

How the community answered

(54 responses)
  • A
    6% (3)
  • B
    19% (10)
  • C
    63% (34)
  • D
    13% (7)

Why each option

Once an e-discovery request is received, a legal hold is triggered that supersedes any existing data retention or deletion policies - destroying data at this point constitutes spoliation of evidence.

ADelete files and email exceeding policy thresholds and turn over the remaining files and

Deleting files and email that exceed policy thresholds after an e-discovery request has been received is spoliation of evidence and violates the legal hold, regardless of internal policy violations.

BDelete email over the policy threshold and hand over the remaining emails and all of the

Deleting email exceeding the retention threshold after a legal hold is triggered is spoliation - the e-discovery obligation overrides the 90-day retention policy once litigation is reasonably anticipated.

CProvide the 1Tb of files on the network and the 300Mb of email files regardless of age.Correct

An e-discovery request creates an immediate legal hold obligation requiring all potentially relevant data to be preserved exactly as it exists, regardless of whether it violates internal retention schedules or storage quotas. Providing the full 1TB of files and 300MB of email in their entirety fulfills the legal obligation. Deleting any data after receiving the legal hold - even data that exceeds policy thresholds - constitutes spoliation of evidence and exposes the company to severe legal sanctions.

DProvide the first 200Mb of e-mail and the first 500Mb of files as per policy.

Providing only the portion of data that conforms to policy quotas is an incomplete production that fails to satisfy the legal discovery obligation and may be treated as intentional withholding.

Concept tested: Legal hold and e-discovery obligations overriding retention policy

Source: https://www.justice.gov/archives/jm/civil-resource-manual-215-electronic-discovery-and-preservation-evidence

Topics

#e-discovery#data retention#legal holds#compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice