220-1102 Question 203
Single answerBest practicesA technician is preparing to dispose of several retired company laptops after a hardware refresh. The devices were used by the finance department and contain SSDs with confidential payroll data. Company policy requires reducing the risk of data exposure while following standard disposal best practices. Which action should the technician take FIRST before sending the laptops to an approved recycler?
- A
Perform a full format on each SSD and then attach an "out of service" tag
- B
Use the operating system's recycle bin cleanup tools and then remove the devices from the domain
- C
Verify the organization's disposal policy and perform secure data sanitization appropriate for SSDs before documenting chain of custody
- D
Remove the user profiles from each laptop and then donate the systems to a local nonprofit
Show answer and explanation
Correct answer: C
Explanation
For retired systems containing sensitive information, the best-practice approach is to begin with the organization's documented disposal policy and then apply an approved data sanitization method appropriate to the media type. SSDs should not be treated the same as traditional hard drives because standard formatting and simple file deletion are not sufficient to ensure data is unrecoverable. Industry guidance such as NIST SP 800-88 Revision 1 emphasizes selecting proper media sanitization methods based on the storage technology and documenting the process. In an A+ Core 2 context, candidates should recognize that secure disposal includes policy compliance, appropriate sanitization, and documentation such as asset tracking or chain of custody before equipment leaves organizational control.
- A. Incorrect.
Incorrect. A full format does not reliably sanitize confidential data, especially on SSDs where wear leveling can leave data in cells not directly overwritten by standard formatting. Tagging equipment as out of service may be part of asset handling, but it does not address secure data destruction requirements.
- B. Incorrect.
Incorrect. Emptying recycle bins or using cleanup tools only removes references to files in the operating system and does not securely erase sensitive data. Removing the devices from the domain is an administrative step, not a data sanitization method.
- C. Correct.
Correct. Best practice is to follow the organization's approved disposal and data retention policies first, then use a proper sanitization method suitable for SSDs, such as manufacturer-supported secure erase or an approved organizational process. Documenting the chain of custody helps maintain accountability and supports security and compliance requirements during disposal.
- D. Incorrect.
Incorrect. Deleting user profiles does not securely remove underlying data from storage. Donating devices before approved sanitization and disposal processing would create a serious security risk, especially for systems that held finance data.