CISA Practice Question: Information Systems Operations and Business Resilience
An organization is disposing of old servers. The IS auditor reviews the asset disposition process and finds that hard drives are being erased using a standard format command. What is the auditor's primary concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The data on the hard drives may still be recoverable.
Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The drives are not being tested for functionality.
Why it's wrong here
A standard format command overwrites only file system metadata, leaving the underlying data recoverable with forensic tools, so residual data may persist on the drives. Testing functionality is tempting because disposition processes do verify hardware, but that is not the primary concern when sensitive data remains readable.
- ✓
The data on the hard drives may still be recoverable.
Why this is correct
A standard format rewrites file system structures but leaves the underlying data blocks intact, so forensic tools can recover residual information. This addresses the stem's disposal scenario, where erasure must render data unrecoverable before servers leave organisational control.
- ✗
The software licenses are not being transferred.
Why it's wrong here
Licence transfer concerns software asset management, not the confidentiality of residual data on the drives. A standard format leaves recoverable remnants, so the auditor's primary concern is inadequate sanitisation before disposal. Licence reconciliation would be the correct focus when auditing software entitlements during decommissioning.
- ✗
The servers are not being recycled for environmental compliance.
Why it's wrong here
Environmental recycling addresses hardware disposal compliance, not data remanence. A standard format leaves recoverable remnants on the platters, so the auditor's primary concern is inadequate sanitisation. Recycling certification would be the correct focus when auditing an organisation's e-waste and environmental obligations.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.