CISSP Asset Security Practice Question
An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-cut shredding
Cross-cut shredding reduces paper to small particles, making reconstruction extremely difficult and is a common method for destroying paper records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cross-cut shredding
Why this is correct
Cross-cut shredding is the most appropriate physical destruction method for paper records containing sensitive financial data. This process cuts paper into small, irregular, confetti-like pieces, making reconstruction practically impossible, unlike strip-cut shredding which leaves longer strips. It ensures that the information cannot be recovered or deciphered, thereby meeting stringent data retention and destruction policy requirements for physical documents.
- ✗
Overwriting with random patterns multiple times
Why it's wrong here
Overwriting with random patterns multiple times is a data sanitization technique exclusively designed for magnetic storage media, such as hard disk drives or magnetic tapes. This method involves writing new data, often random binary patterns, over existing data sectors multiple times to obscure residual magnetic traces and prevent data recovery. It is entirely ineffective for paper documents, as it relies on magnetic properties that paper does not possess.
- ✗
Cryptographic erasure
Why it's wrong here
Cryptographic erasure, also known as crypto-shredding, is a logical data sanitization method applicable only to data that has been encrypted at rest. This technique involves securely deleting or destroying the encryption key(s) used to protect the data, rendering the underlying encrypted data unreadable and irrecoverable without the key. Since paper documents are not encrypted digital data, this method has no applicability to their destruction.
- ✗
Degaussing with a strong magnetic field
Why it's wrong here
Degaussing is a specialized data destruction method that uses a strong alternating magnetic field to neutralize the magnetic domains on magnetic storage media, such as hard drives, floppy disks, or magnetic tapes. This process effectively erases all data by scrambling the magnetic patterns, making the media unreadable and unrecoverable. As paper records do not store information magnetically, degaussing has no effect on their content and is therefore unsuitable for their destruction.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Retention policy
A retention policy is a set of rules that determines how long an organization keeps its data and what happens to it when the retention period expires.
Key term
Data retention
Data retention is the practice of keeping data for a specific period to meet legal, business, or compliance needs, and then securely disposing of it.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.