easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: During a security audit, it is discovered that an…
During a security audit, it is discovered that an old server's hard drives were simply deleted and the server was sold to a recycler. The recycler later reported finding readable files on the drives. Which data disposal standard was violated?
⚠ Common exam trap
CompTIA often tests the distinction between a general security framework (like HIPAA or PCI DSS) and a specific technical disposal standard (NIST SP 800-88), trapping candidates who confuse compliance requirements with the actual sanitization methodology.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NIST SP 800-88
NIST SP 800-88 provides guidelines for media sanitization, including clear, purge, and destroy methods. Simply deleting files only removes directory pointers, leaving data recoverable until overwritten. The recycler's ability to read files indicates that the drives were not sanitized according to NIST SP 800-88 standards, which require overwriting or physical destruction for sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NIST SP 800-88
Why this is correct
NIST SP 800-88 provides comprehensive guidelines for media sanitization, defining methods such as 'Clear,' 'Purge,' and 'Destroy' to ensure data is unrecoverable. A security audit discovering improper data disposal, such as simple file deletion or reformatting, would directly cite a failure to adhere to these specific technical standards. This standard is the authoritative source for secure data destruction practices, making it the most direct and relevant answer for a violation involving inadequate sanitization procedures.
- ✗
PCI DSS
Why it's wrong here
The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations handling branded credit cards from the major card schemes. While PCI DSS does include requirements for secure disposal of media containing cardholder data, it is a specific standard focused solely on payment card information. The question describes a general security audit and data disposal issue, making NIST SP 800-88 the universally applicable and direct standard for media sanitization procedures, regardless of the data type involved.
- ✗
HIPAA
Why it's wrong here
The Health Insurance Portability and Accountability Act (HIPAA) mandates the protection and secure handling of Protected Health Information (PHI). While HIPAA requires covered entities to implement appropriate safeguards for PHI, including secure disposal, it does not specify the technical methods or procedures for data sanitization. Instead, organizations are expected to adopt industry best practices and standards, such as NIST SP 800-88, to meet HIPAA's general security requirements for data destruction.
- ✗
ISO 27001
Why it's wrong here
ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a framework for managing information security risks and requires organizations to have policies and procedures for secure disposal of information. However, ISO 27001 is a management standard that outlines *what* needs to be done, not *how* to technically perform data sanitization; the specific technical guidelines for media sanitization are found in documents like NIST SP 800-88.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.