CISSP Asset Security Practice Question
An organization is decommissioning a server containing magnetic hard drives that stored sensitive data. The data has been backed up to tape and the drives are to be reused. Which media sanitization method is most appropriate to ensure data cannot be recovered while preserving the drives for reuse?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Overwriting the entire drive with a recognized standard
Overwriting (e.g., DoD 5220.22-M) is effective for magnetic media and allows reuse; degaussing and destruction do not allow reuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Degaussing
Why it's wrong here
Degaussing involves exposing magnetic media to a strong magnetic field to randomize the magnetic domains, thereby erasing the data. While highly effective for data destruction on traditional hard drives and magnetic tapes, this process typically renders the drive inoperable and unsuitable for reuse. If the organization's goal is to sanitize the drive for repurposing or resale, degaussing is an inappropriate method as it destroys the hardware.
- ✓
Overwriting the entire drive with a recognized standard
Why this is correct
Overwriting is a data sanitization method that involves writing new data (e.g., patterns of ones and zeros) over all addressable locations on the storage media, often multiple times. Adhering to a recognized standard, such as NIST SP 800-88 "Purge" guidelines, ensures that the original data is rendered unrecoverable using state-of-the-art laboratory techniques. This method effectively sanitizes the drive while preserving its functionality, making it suitable for secure reuse or repurposing.
- ✗
Physical destruction (shredding)
Why it's wrong here
Physical destruction, such as shredding, pulverizing, or incineration, is a definitive method of data destruction that renders the storage media completely unusable and the data irrecoverable. While extremely effective for ensuring data security, this approach permanently eliminates the possibility of reusing the server's drive. If the organization intends to extract any residual value from the hardware or repurpose it, physical destruction is not the appropriate choice.
- ✗
Cryptographic erasure
Why it's wrong here
Cryptographic erasure relies on the premise that the data on the drive was previously encrypted using strong encryption, and the encryption key is then securely deleted or rendered inaccessible. This method effectively makes the encrypted data unreadable without the key. However, if the data on the server's magnetic drive was not encrypted in the first place, or if the encryption key management was flawed, cryptographic erasure offers no data sanitization benefit and would be ineffective.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.