Participate in the Disposal Process ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is decommissioning a system that contains data subject to a regulatory retention period of ten years. The system has been in operation for eight years. The company is under financial pressure to reduce storage costs. What is the best approach?

   • ARetain the data on the current system for two more years.
   • BRetain the data for two more years, possibly by archiving it to a lower-cost storage solution.
   • CAnonymize the data and then dispose of it.
   • DDispose of the data now to save costs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital is decommissioning old MRI machines that contain internal hard drives with patient health information. The hospital's policy requires that media be sanitized before disposal. Which procedure should the hospital follow?

   • AReformat the hard drives and then sell the machines to a refurbisher.
   • BEncrypt the hard drives and then donate the machines to a charity.
   • CDelete the patient files from the hard drives and then dispose of the machines in regular trash.
   • DRemove the hard drives and physically destroy them using a certified shredder.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a primary security requirement when disposing of media that has stored classified information?

   • ATransfer the media to a third-party recycler without documentation
   • BStore the media in a secure facility until it is naturally obsolete
   • CReformat the media and reuse it for non-sensitive purposes
   • DEnsure the media is sanitized or destroyed to a degree that prevents data recovery
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is decommissioning a database that contains customer data. The company is subject to a legal hold that requires all data related to an ongoing lawsuit to be preserved. The database also contains data that has exceeded its normal retention period. What should the company do?

   • AAnonymize the data subject to the legal hold and then dispose of it.
   • BPreserve all data until the legal hold is lifted.
   • CDispose of all data because the retention period has expired.
   • DPreserve the data subject to the legal hold and dispose of the rest according to the retention policy.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is decommissioning a server that contains both classified and unclassified data. The classified data is stored on a separate hard drive. The company's policy requires that classified data be destroyed, while unclassified data can be sanitized. What is the most appropriate procedure?

   • APhysically destroy both hard drives to ensure no data is recoverable.
   • BEncrypt both hard drives and then dispose of them.
   • CPhysically destroy the classified hard drive and sanitize the unclassified hard drive.
   • DSanitize both hard drives using the same method.
   Reveal Solution Discussion Select an answer first