A company has completed a decommissioning project and the security team is auditing the results. They find that the disposal logs are incomplete for several servers. What is the most appropriate action?

Accept the logs as sufficient because the project is complete.

Assume the servers were disposed of because they are no longer in the asset inventory.

Mark the disposal as complete and note the incomplete logs in the final report.

Conduct a follow-up audit to verify that the servers were actually disposed of.

A data center is decommissioning a storage array that contains backup tapes. The tapes are labeled as containing sensitive data. The disposal procedure must ensure that the data cannot be recovered. Which procedure is most appropriate?

Encrypt the tapes and then store them in a secure offsite facility.

Degauss the tapes and then physically shred them.

Reformat the tapes using a tape drive and then return them to the manufacturer.

Delete the files on the tapes using a computer and then dispose of them in the trash.

A company is decommissioning a legacy system that contains both financial records and personnel files. The financial records have a seven-year retention requirement, while the personnel files have a three-year requirement. The system is being decommissioned after five years. What is the best approach?

Dispose of all data now because the system is being decommissioned.

Retain all data for two more years to satisfy the longer retention period.

Anonymize the financial records and dispose of all data immediately.

Retain the financial records for two more years and dispose of the personnel files now.

When can data be disposed of under a data retention policy?

Only after the retention period has expired

When the data owner requests deletion

As soon as the data is no longer actively used

When determining the security requirements for disposing of an information system, which of the following must be considered to ensure the disposal process aligns with legal and regulatory constraints?

The age of the system and the original purchase price

The number of users who had access to the system and their current employment status

The physical location of the system and the cost of the disposal method

The classification of the data stored on the system and any applicable legal or regulatory retention requirements

Information Systems Security Engineering Professional

Domain 5Objective 4

Participate in the Disposal Process ISSEP Practice Questions (Page 2)

Part of the Secure Operations, Change Management and Disposal domain, which accounts for 14% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

14%of the exam

Questions 6–10

6expert · hard
A company has completed a decommissioning project and the security team is auditing the results. They find that the disposal logs are incomplete for several servers. What is the most appropriate action?
Select an answer first
7application · medium
A data center is decommissioning a storage array that contains backup tapes. The tapes are labeled as containing sensitive data. The disposal procedure must ensure that the data cannot be recovered. Which procedure is most appropriate?
Select an answer first
8expert · hard
A company is decommissioning a legacy system that contains both financial records and personnel files. The financial records have a seven-year retention requirement, while the personnel files have a three-year requirement. The system is being decommissioned after five years. What is the best approach?
Select an answer first
9foundation · easy
When can data be disposed of under a data retention policy?
Select an answer first
10foundation · easy
When determining the security requirements for disposing of an information system, which of the following must be considered to ensure the disposal process aligns with legal and regulatory constraints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.