LPIC-1 Administrative Tasks Practice Question
Which three actions can an administrator take to securely erase data on a disk before decommissioning?
⚠ Common exam trap
A common mix-up: candidates think `mkfs` or partition deletion fully erases data, when in fact they only remove logical pointers, leaving the raw data recoverable with simple forensic tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run dd if=/dev/urandom of=/dev/sda.
Option C is correct because writing random data from /dev/urandom over the entire raw device /dev/sda with dd overwrites every sector, making the original data unrecoverable. Option D is correct because shred -n 3 /dev/sda performs three passes of overwriting on the block device, which securely destroys the prior contents. Option E is correct because hdparm --security-erase invokes the drive's ATA Secure Erase firmware command, which securely erases all sectors including remapped ones. Option A is not correct because mkfs only creates a new filesystem and leaves the underlying data blocks intact and recoverable. Option B is not correct because deleting and recreating a partition only modifies the partition table and does not overwrite the data stored on the disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Format the disk with mkfs.
Why it's wrong here
mkfs writes fresh filesystem structures over part of the device but leaves most existing blocks intact and recoverable with forensic tools. Formatting is the correct action when preparing a disk for immediate reuse, where the goal is a usable filesystem rather than assured destruction of prior contents.
- ✗
Delete the partition and create a new one.
Why it's wrong here
Recreating the partition table alters filesystem metadata only; the underlying blocks still hold recoverable data. Partitioning is the right action when repurposing a disk for a new layout or operating system, not when the requirement is rendering prior contents unrecoverable before disposal.
- ✓
Run dd if=/dev/urandom of=/dev/sda.
Why this is correct
Writing pseudorandom bytes from /dev/urandom across the whole block device overwrites every sector, including filesystem metadata, making prior data unrecoverable. This satisfies the secure erasure requirement by destroying the original contents rather than merely unlinking files.
- ✓
Run shred -n 3 /dev/sda.
Why this is correct
shred overwrites the target device with patterned data across multiple passes, specified here as three, so residual magnetic traces of the original content are destroyed. Applied to /dev/sda it erases the entire disk, meeting the decommissioning requirement.
- ✓
Use the hdparm command with the --security-erase option.
Why this is correct
hdparm --security-erase issues the ATA Secure Erase command, which the drive firmware uses to overwrite all sectors, including remapped and hidden areas unreachable by software tools. This satisfies secure decommissioning by erasing data at the hardware level.
Go deeper
Related to this question
About these practice questions
One of 402 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.