A government agency is decommissioning a server that contains classified data. The server's hard drives are still functional. The agency's policy requires that classified data be destroyed beyond recovery. What is the most appropriate disposal method?

Overwrite the hard drives with a single pass of random data.

Degauss the hard drives and then physically destroy them.

Format the hard drives and reuse them in a non-classified environment.

Sell the hard drives to a certified recycler without wiping them.

What is the primary purpose of auditing retention practices?

To reduce the cost of storage by deleting assets early

To verify that retention policies are being followed and are compliant with regulations

To ensure that assets are retained longer than required

To identify which assets are most valuable to the organization

A startup company has no formal asset retention policy. Employees keep emails, documents, and project files indefinitely, and the company is now facing a lawsuit that requires producing relevant records. The lack of a retention policy has made it difficult to identify which records are relevant and which can be discarded. What is the most appropriate action?

Retain all records indefinitely to avoid any future e-discovery issues.

Immediately delete all old emails and documents to reduce the burden of e-discovery.

Hire an external legal team to handle the lawsuit and ignore the retention issue.

Develop and implement a retention policy that classifies assets and defines retention periods, and apply it going forward.

An organization is using a legacy customer relationship management (CRM) application that the vendor has placed in End of Support (EOS) status. Which statement best describes the primary risk of continuing to operate this application?

The application will automatically cease to function after the End of Support date, causing immediate service disruption.

The vendor will continue to provide security patches but will charge a premium for technical support.

The organization will lose access to the application's source code, making it impossible to remediate any future vulnerabilities.

The vendor will no longer provide security patches or technical support, increasing the likelihood that known vulnerabilities remain exploitable.

What should an organization do if a retention audit finds that some assets were disposed of before their required retention period ended?

Restore the assets from backup if possible

Extend the retention period for all future assets

Document the finding and implement corrective actions to prevent recurrence

Ignore the finding if the assets were not sensitive

Certified Information Systems Security Professional

Domain 2Objective 5

2.5 - Ensure Appropriate Asset Retention (e.g., End of Life (EOL), End of Support) CISSP Practice Questions (Page 3)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

10concepts

10%of the exam

10 Concepts in This Objective

Asset Retention Fundamentals
Retention Requirements and Drivers
Retention Policies and Procedures
Retention Schedules and Classification
End of Life (EOL)
End of Support (EOS)
EOL vs. EOS Distinction
Transition Planning for EOL/EOS
Secure Disposal and Sanitization
Retention Auditing and Compliance

Questions 11–15

11application · medium
A government agency is decommissioning a server that contains classified data. The server's hard drives are still functional. The agency's policy requires that classified data be destroyed beyond recovery. What is the most appropriate disposal method?
Select an answer first
12foundation · easy
What is the primary purpose of auditing retention practices?
Select an answer first
13application · medium
A startup company has no formal asset retention policy. Employees keep emails, documents, and project files indefinitely, and the company is now facing a lawsuit that requires producing relevant records. The lack of a retention policy has made it difficult to identify which records are relevant and which can be discarded. What is the most appropriate action?
Select an answer first
14foundation · medium
An organization is using a legacy customer relationship management (CRM) application that the vendor has placed in End of Support (EOS) status. Which statement best describes the primary risk of continuing to operate this application?
Select an answer first
15foundation · easy
What should an organization do if a retention audit finds that some assets were disposed of before their required retention period ended?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.