220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deleting all files and emptying the recycle bin.

  Why it's wrong here

  Deleting files and emptying the recycle bin only removes file system references (directory entries) to the data, leaving the actual bits on the hard drive platters. The sectors that were previously allocated to those files still contain the original data, and are merely marked as free for reuse. Specialized data recovery software can scan for these unallocated sectors and reconstruct the files, often even if the drive is showing as empty. Without a secure overwrite or physical destruction, the data persists and can be recovered.

• ✗

  Performing a standard format of the hard drive.

  Why it's wrong here

  A standard (high-level) format, such as the quick format commonly performed in operating systems, only builds a new file system structure, replacing the file allocation tables and other metadata while leaving the user data sectors untouched. Unlike a low-level format or secure erase, a standard format does not write data over every sector, so the previous contents remain fully recoverable by forensic tools. Even a full format in many modern operating systems simply checks for bad sectors and zeros out some metadata, but it does not guarantee overwriting all user data. Therefore, this method fails to meet the security requirements for disposal.

• ✗

  Using disk encryption software that meets industry standards.

  Why it's wrong here

  Disk encryption software, such as BitLocker or FileVault, is a strong protective measure during the laptop's lifecycle, but it is not a disposal method by itself. If the drive is disposed of without first performing a cryptographic erase (destroying the decryption keys), the ciphertext containing the user data remains on the platters and could theoretically be attacked offline. Merely enabling encryption does not scrub the drive; the encryption key is typically stored on the drive or in a key manager, and unless it is securely deleted, the encrypted data is still accessible to someone who can extract the key. Physical destruction is the only way to guarantee that the encrypted data cannot be retrieved, because the key recovery is impossible once the medium is destroyed.

• ✓

  Physically destroying the hard drive platters.

  Why this is correct

  Physically destroying the hard drive platters is the most reliable and definitive method for ensuring that data cannot be recovered, as it eliminates the storage medium itself. Techniques such as shredding, drilling through the platters, or disintegrating the drive render the magnetic layers unreadable and make any forensic reconstruction infeasible. This approach aligns with the highest level of security in data disposal (e.g., NIST SP 800-88), which recommends device destruction for media containing sensitive data. Once the physical structure of the platters is compromised, no software or hardware recovery method can retrieve the data, guaranteeing complete data destruction.

Go deeper

Related to this question