A security engineer has been assigned to work on a request from outside counsel. The security engineer must provide all email correspondence within a specific date range. Which of the following…

Question

Options

• ASend litigation hold notifications to identify affected data.
• BForm a team to determine root cause analysis.
• CEstablish the chain of custody.
• DDetermine the type of preservation needed for evidence.

Explanation

Option A is correct. When outside counsel requests email correspondence, the immediate priority is issuing a litigation hold - a formal notification that suspends normal data retention/deletion policies so relevant emails are not purged before they can be collected. Failing to do this first risks spoliation of evidence, which can have serious legal consequences.

Why the distractors are wrong:

• B (Root cause analysis) is an incident response activity used to investigate a security breach, not a legal discovery request - wrong context entirely.
• C (Chain of custody) is critical but comes after data is identified and preserved; you can't document custody of data you haven't yet secured.
• D (Determine preservation type) matters, but without first freezing the data via a litigation hold, emails could be auto-deleted by retention policies while you're still planning - putting the cart before the horse.

Memory tip: Think of the litigation hold as "hitting pause" on the entire mailbox system. Just like freezing a crime scene before investigating it, you must stop the clock on data destruction before any other steps. If you remember "preserve first, analyze second", you'll nail these legal/eDiscovery questions.

No community discussion yet for this question.