What Requirement Describes Maintaining Backups After Device Destruction?

SY0-701 By islever Editorial Last updated

Short answer

A Data retention

Question

A legal department must maintain a backup from all devices that have been shredded and recycled by a third party. Which of the following best describes this requirement?
  1. Data retention Correct Answer
  2. Certification
  3. Sanitization
  4. Destruction

Key Takeaways

The question tests whether candidates can distinguish between hardware sanitization processes and the ongoing legal duty to archive records, with the common trap being confusion over audit certificates or destruction paperwork.

This question tests the distinction between physical data destruction and regulatory obligations to preserve information for legal purposes. The community consensus strongly supports data retention, emphasizing that maintaining backups post-destruction aligns with compliance mandates rather than disposal verification.

Common mistake: Many candidates incorrectly select Certification, assuming the scenario requires formal proof of disposal from the third-party vendor. However, the prompt explicitly states the department must 'maintain a backup,' which directly points to retention policies rather than verification documents.

Expert Analysis

Core Concept: Data Lifecycle vs. Legal Compliance

The scenario highlights a critical intersection between physical asset disposal and organizational governance. While the devices are physically destroyed, the legal mandate focuses on preserving information for potential litigation or regulatory audits. As noted by community member b290d8a, the keyword phrase "maintain a backup" immediately signals a retention requirement rather than a disposal procedure.

Why Data Retention is the Correct Answer

Data retention refers to the policy and practice of preserving digital records for a defined period to satisfy legal, regulatory, or business obligations. In this case, the legal department must keep copies of the data even after the hardware has been shredded and recycled. Community consensus (users Cocopqr, Fourgehan, and 9149f41) correctly emphasizes that retention ensures compliance with industry standards and prepares the organization for future legal discovery, regardless of the physical state of the original storage media.

Analyzing the Distractors

Many test-takers incorrectly choose Certification. User CSue argues that certification provides proof of destruction, which is valuable for audit trails. However, certification verifies that the data was destroyed, not that it is actively preserved. The prompt explicitly requires maintaining a backup, which contradicts the purpose of certification. Similarly, Sanitization and Destruction focus on rendering data unreadable or eliminating the physical medium. These options address the third-party recycling process but completely ignore the legal directive to keep a copy. Recognizing the difference between destroying the source and archiving the data is essential for SY0-701 success.

Official Reference

https://www.iso.org/standard/27001.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When answering compliance-focused questions, carefully parse action verbs like "maintain," "preserve," or "keep," as they typically indicate retention policies rather than disposal methods. Always match the exact wording in the stem to the definition of the correct option, ignoring contextual distractions about third-party vendors or physical destruction.

Community Votes

A
71%
B
29%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Fourgehan 👍 4 Answered A
    Data retention refers to the practice of preserving and storing data for a specified period to meet legal, regulatory, or business requirements. In this case, the legal department needs to maintain backups of data from devices that have been shredded and recycled, ensuring compliance with legal or organizational policies
  2. e2ba0ff 👍 3 Answered B
    Certification ■ Acts as proof that data or hardware has been securely disposed of ■ Important for organizations with regulatory requirements ■ Creates an audit log of sanitization, disposal, or destruction
  3. 9149f41 👍 2 Answered A
    Retention is relevant to the legal issue. Sanitization is not relevant to the legal issue; just destroy data in the best way. Retention in this scenario is included as a legal or compliance requirement. The legal department needs to keep backups to meet regulatory obligations, prepare for potential litigation, or ensure compliance with industry standards.
  4. Cocopqr 👍 2 Answered A
    A. Data retention. Data retention is the practice of keeping data for a specified period. In this case, the legal department is required to maintain a backup of data even after physical destruction. This ensures that the data can be accessed if needed for legal or regulatory purposes.
  5. b290d8a 👍 2 Answered A
    Keywords are "Maintain a backup" therefore retention is the correct response.
Show 1 more comment
  1. CSue 👍 1 Answered B
    The legal department needs to ensure that the third party responsible for shredding and recycling the devices provides proof or documentation that the data has been properly destroyed, which is known as certification. Certification typically involves a formal report or audit trail from the third party confirming that proper data destruction or sanitization procedures were followed

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide