SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run a quick format and remove the asset tags after the files are deleted.

  Why it's wrong here

  A quick format only rebuilds file system metadata and does not overwrite the raw NAND cells where file remnants persist. Because SSDs use wear leveling and garbage collection, deleted data can remain in inaccessible blocks and be recovered with forensic tools even after a format. Removing asset tags is an asset-tracking step, not a data-sanitization control, so the media still contains sensitive information and the process is unverifiable without documentation.

• ✓

  Perform a cryptographic erase by destroying the encryption keys and document the sanitization process.

  Why this is correct

  For encrypted SSDs, destroying the encryption keys is an effective and practical sanitization method because the data becomes unreadable even if the drive is later examined. This approach matches the media type and the fact that full-disk encryption was used. Proper documentation also supports accountability and compliance. It is stronger than merely deleting files or performing a superficial format, which may leave recoverable data behind.

• ✗

  Degauss the SSDs and then store them in the disposal room until pickup.

  Why it's wrong here

  Degaussing generates a strong magnetic field to randomize magnetic domains, which is effective for HDDs and tape, but SSDs store data as electrical charge in floating-gate transistors with no ferromagnetic substrate. A degausser will not reliably alter the charge state of NAND flash, and it may damage the drive's controller or circuitry without erasing data. Leaving the drives in a disposal room without chain-of-custody or completion evidence also violates standard media sanitization and compliance requirements.

• ✗

  Overwrite the drives once with random data and consider the devices ready for resale.

  Why it's wrong here

  Overwriting an SSD even once is not reliable because wear leveling and over-provisioning can redirect writes away from physical blocks that already contain data, leaving residual copies in cells that the OS cannot address. Unlike HDDs, where a single overwrite may be acceptable under some standards, NAND flash's architecture requires the ATA Secure Erase command or a cryptographic erase for dependable sanitization. Declaring the devices ready for resale without verifying the overwrite or documenting the process creates a serious data leakage and legal liability risk.

Go deeper

Related to this question