Data Destruction CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses a third-party vendor to destroy hard drives. The vendor provides a certificate of destruction, but the company wants to ensure that the destruction process is auditable. What should the company do?

   • ARequire the vendor to provide a video recording of each destruction.
   • BConduct periodic audits of the vendor's destruction facility and process.
   • CAsk the vendor to sign a confidentiality agreement.
   • DRely on the certificate of destruction as sufficient evidence.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating from a cloud provider to an on-premises data center. The cloud provider stores backups that contain personal data. The company's contract with the provider includes a data destruction clause, but the provider is reluctant to provide a certificate of destruction. What is the best course of action?

   • AIgnore the issue because the data is in the cloud and the provider is responsible.
   • BEscalate the issue to the provider's legal team and, if necessary, involve a third-party auditor to verify destruction.
   • CTerminate the contract immediately and assume the data will be destroyed.
   • DAccept the provider's assurance that the data will be deleted and move on.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company uses a cloud provider for backup storage and is terminating the contract. The company must ensure that all personal data is destroyed in the cloud environment. What is the most important step the company should take?

   • AImmediately cancel the account and move on, as the provider is responsible for data destruction.
   • BAsk the provider to delete the data and rely on their verbal assurance.
   • CReview the contract for data destruction clauses and require a certificate of destruction from the provider.
   • DAssume the provider will destroy the data as part of standard decommissioning.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational company is implementing a data destruction training program. The training must ensure that employees understand when to destroy data and how to do it securely, while also covering the legal consequences of improper destruction. Which training approach is most effective?

   • AOffer a combination of initial onboarding training, annual refresher courses, and targeted updates when policies or regulations change.
   • BProvide a one-time online module that employees must complete within 90 days of hire.
   • CConduct annual instructor-led sessions that include real-world scenarios and a quiz on destruction procedures.
   • DDistribute a detailed policy document and require employees to sign an acknowledgment that they have read it.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has just completed a data destruction project for a batch of decommissioned servers. The project manager wants to verify that the destruction was effective. Which of the following is the most reliable method of verification?

   • AObtain a certificate of destruction from the vendor that performed the destruction.
   • BPerform a sample audit by attempting to recover data from a random selection of the destroyed media.
   • CTrust the vendor's reputation and assume the destruction was successful.
   • DReview the inventory list of drives that were scheduled for destruction.
   Reveal Solution Discussion Select an answer first