CISSP Asset Security Practice Question
A security professional is tasked with sanitizing a set of hard drives that contain sensitive corporate data. The organization wants to ensure that data cannot be recovered, even by advanced forensic methods. According to NIST SP 800-88, which THREE methods are considered appropriate for sanitization? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physically shredding the drive into small pieces
NIST SP 800-88 defines clearing, purging, and destroying as sanitization methods. Overwriting is a form of clearing/purging, degaussing is purging for magnetic media, and physical destruction is destroying. Cryptographic erasure is effective for encrypted media but is not a separate category in the standard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Physically shredding the drive into small pieces
Why this is correct
Physically shredding a drive into small, unrecoverable pieces is the most secure and definitive method of data sanitization, as it renders the storage media completely unusable and the data inaccessible. This process involves mechanical destruction, breaking the platters or flash memory chips into fragments too small to reconstruct, thereby eliminating any possibility of data retrieval, even with advanced forensic techniques. It is often considered the ultimate method for highly sensitive data.
- ✓
Degaussing the drive with a high-energy magnetic field
Why this is correct
Degaussing involves exposing magnetic storage media, such as hard disk drives (HDDs) or magnetic tapes, to a powerful alternating magnetic field. This process effectively randomizes the magnetic domains on the platters, thereby erasing all recorded data and rendering it unrecoverable. However, degaussing is ineffective for non-magnetic media like Solid State Drives (SSDs) or optical media, as their data storage principles do not rely on magnetic properties.
- ✗
Deleting all files and emptying the recycle bin
Why it's wrong here
Deleting files and emptying the recycle bin merely removes the pointers to the data within the file system, marking the space as available for new data. The actual data blocks remain on the storage medium until they are subsequently overwritten by new information. Consequently, this method offers no data sanitization and is highly susceptible to recovery using readily available forensic tools, making it unsuitable for protecting sensitive information.
- ✓
Overwriting the entire drive with multiple passes of random data
Why this is correct
Overwriting the entire drive with multiple passes of random data is a recognized data sanitization method, as specified by standards like NIST SP 800-88. This process involves writing new, often random, data patterns across every sector of the storage medium multiple times, effectively obscuring and replacing the original sensitive information. Multiple passes enhance the assurance that residual magnetic traces of the original data are eradicated, making recovery practically impossible.
- ✗
Reformatting the drive and reinstalling the operating system
Why it's wrong here
Reformatting a drive, even a full format, primarily reinitializes the file system structure and checks for bad sectors, but typically does not overwrite the underlying data blocks. While it makes the data appear inaccessible to the operating system, the original information persists on the drive and can often be recovered using data recovery software. This method is akin to a quick delete and is insufficient for secure data sanitization, especially for sensitive data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.