A legal department must maintain a backup from all devices that have been shredded and recycled by a third party. Which of the following best describes this requirement?

The correct answer is A. Data retention. Data retention (A) is correct because the legal department is required to keep copies of data even after the physical devices are destroyed - this is the definition of a data retention policy, which governs how long and in what form data must be preserved for legal, regulatory…

Submitted by takeshi77· Mar 6, 2026Security program management and oversight

Question

Options

AData retention
BCertification
CSanitization
DDestruction

How the community answered

(32 responses)

A
94% (30)
B
3% (1)
D
3% (1)

Explanation

Data retention (A) is correct because the legal department is required to keep copies of data even after the physical devices are destroyed - this is the definition of a data retention policy, which governs how long and in what form data must be preserved for legal, regulatory, or compliance purposes.

Certification (B) refers to a formal attestation or credential (e.g., a third-party certificate confirming destruction occurred) - it's related to the process but doesn't describe the requirement to keep the backup. Sanitization (C) is the process of securely wiping data from a device before disposal, ensuring it can't be recovered - the opposite of preserving it. Destruction (D) refers to physically destroying the device or media itself, which is what the third party is doing - not what the legal department's requirement is.

Memory tip: Think of "retention" as retaining (keeping) data. If the question involves a legal or compliance obligation to hold onto data - regardless of what happens to the hardware - that's always data retention.

Topics

#Data retention#Legal compliance#Data backup#Information lifecycle

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice