easyMultiple Choice
CCSP Practice Question: After decommissioning a cloud database, a company…
After decommissioning a cloud database, a company is concerned about data remanence. They have overwritten all storage blocks with zeros. However, regulatory auditors require proof that the data is unrecoverable. What additional step should the company take?
⚠ Common exam trap
The trap here is that candidates mistakenly apply on-premises data destruction methods (physical destruction, shredding, degaussing) to a cloud environment, forgetting that the customer lacks physical access and must rely on the provider's attestation and compliance documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request a certificate of destruction from the cloud provider
In a cloud environment, the customer does not have physical access to the underlying storage media. Overwriting with zeros is a software-based sanitization method, but cloud providers typically do not allow customers to perform physical destruction or degaussing. The correct additional step is to request a certificate of destruction from the cloud provider, which serves as auditable proof that the provider has performed its own secure disposal process (e.g., NIST SP 800-88 compliant media sanitization) and that the data is unrecoverable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physically destroy the storage media
Why it's wrong here
Physical destruction of media the provider owns is not something the customer can perform or evidence in a cloud environment; auditors need provider-issued certification instead. It is tempting because media destruction is the correct choice for on-premises storage the organisation itself controls and can document.
- ✗
Shred the hard drives
Why it's wrong here
Shredding requires physical possession of the drives, which the customer lacks in a public cloud; the provider must supply destruction evidence. It is tempting because shredding is the correct choice for on-premises hard drives the organisation can physically handle and document itself.
- ✓
Request a certificate of destruction from the cloud provider
Why this is correct
Overwriting blocks with zeros is insufficient evidence for auditors, since the cloud provider controls the underlying media and cannot prove physical erasure. A certificate of destruction documents that the provider securely sanitised or destroyed the media, satisfying the regulatory proof requirement.
- ✗
Degauss the drives
Why it's wrong here
Degaussing applies to magnetic media, yet the overwriting of storage blocks indicates solid-state or virtualised cloud storage, which degaussing cannot erase. It is tempting because degaussing is the correct choice for magnetic tape or spinning-disk media under the organisation's direct physical control.
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.