Decommission Applications CSSLP Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A defense contractor is decommissioning a secure messaging application that stored classified messages on a server with magnetic hard drives. The retention period has expired, and the drives must be disposed of. Which method is MOST appropriate for ensuring the data is irrecoverable?

   • AOverwrite the drives with a single pass of zeros.
   • BEncrypt the drives and store the keys with the security team.
   • CReformat the drives and reuse them in a non-classified environment.
   • DDegauss the drives to destroy the magnetic data.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare organization is retiring a legacy patient-portal application that still receives data feeds from the lab results system. The compliance team requires that the portal's data be preserved for 7 years, but the lab system must continue operating without disruption. What is the FIRST action the decommissioning team should take?

   • ADelete the portal's configuration settings to prevent unauthorized access during the transition.
   • BDocument the dependency on the lab system and coordinate a transition plan before disconnecting the feed.
   • CCancel the portal's software licenses to reduce costs before addressing data or dependencies.
   • DExecute the data destruction procedure to eliminate the portal's data immediately.
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A hospital is decommissioning a patient-scheduling application. The application integrates with the billing system via an API, and the billing system stores patient financial data that must be retained for 7 years. The scheduling application's own data has no retention requirement. The team must archive the scheduling data for potential audits while ensuring the billing system is not disrupted. What is the BEST approach?

   • AArchive the scheduling application's data, then disconnect the API and decommission the application.
   • BDisconnect the API first, then archive the scheduling data.
   • CArchive the billing system's data instead of the scheduling data, since it has a retention requirement.
   • DDelete the scheduling data and rely on the billing system's records for any audit.
   Reveal Solution Discussion Select an answer first