CISSP Asset Security Practice Question
An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?
⚠ Common exam trap
CISSP often tests the applicability of sanitization methods to different media types, and candidates may incorrectly choose degaussing or overwriting for paper records because they are familiar with those methods for electronic media.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-cut shredding
Cross-cut shredding is the best sanitization method for paper records because it physically destroys the paper into small, unreadable pieces, making reconstruction extremely difficult. It is a widely accepted method for destroying sensitive paper documents. Option A is correct as it meets the requirement to prevent reconstruction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cross-cut shredding
Why this is correct
Cross-cut shredding is the most appropriate physical destruction method for paper records containing sensitive financial data. This process cuts paper into small, irregular, confetti-like pieces, making reconstruction practically impossible, unlike strip-cut shredding which leaves longer strips. It ensures that the information cannot be recovered or deciphered, thereby meeting stringent data retention and destruction policy requirements for physical documents.
- ✗
Overwriting with random patterns multiple times
Why it's wrong here
Overwriting with random patterns multiple times is a data sanitization technique exclusively designed for magnetic storage media, such as hard disk drives or magnetic tapes. This method involves writing new data, often random binary patterns, over existing data sectors multiple times to obscure residual magnetic traces and prevent data recovery. It is entirely ineffective for paper documents, as it relies on magnetic properties that paper does not possess.
- ✗
Cryptographic erasure
Why it's wrong here
Cryptographic erasure, also known as crypto-shredding, is a logical data sanitization method applicable only to data that has been encrypted at rest. This technique involves securely deleting or destroying the encryption key(s) used to protect the data, rendering the underlying encrypted data unreadable and irrecoverable without the key. Since paper documents are not encrypted digital data, this method has no applicability to their destruction.
- ✗
Degaussing with a strong magnetic field
Why it's wrong here
Degaussing is a specialized data destruction method that uses a strong alternating magnetic field to neutralize the magnetic domains on magnetic storage media, such as hard drives, floppy disks, or magnetic tapes. This process effectively erases all data by scrambling the magnetic patterns, making the media unreadable and unrecoverable. As paper records do not store information magnetically, degaussing has no effect on their content and is therefore unsuitable for their destruction.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Retention policy
A retention policy is a set of rules that determines how long an organization keeps its data and what happens to it when the retention period expires.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.