Which of the following attacks can be mitigated by proper data retention policies?

Dumpster diving involves searching through physical trash to recover discarded documents, printouts, or storage media containing sensitive information. A data retention policy specifies both how long data must be kept and - critically - the required method of secure disposal when the retention period ends, such as cross-cut shredding for paper or degaussing for magnetic media. Enforcing these destruction procedures eliminates the physical materials that would otherwise be available for a dumpster diving attacker to exploit.

Man-in-the-browser attacks inject malicious code into browser processes to intercept financial transactions and are mitigated by endpoint detection tools and multi-factor authentication, not data retention policies.

Spear phishing is a targeted email social engineering attack mitigated by user security awareness training and email filtering controls, not by policies governing how long data is stored or how it is destroyed.

Watering hole attacks compromise legitimate websites to deliver malware to targeted visitors and are mitigated by web filtering, patch management, and threat intelligence, not data retention policies.