220-1102 Question 527
Single answerRecycling or repurposing best practicesA small medical office is replacing several older desktop PCs. The office manager wants to donate the systems to a local nonprofit, but the PCs currently store patient billing records and scanned IDs on their internal drives. The computers are still functional and will be reused. Which action should the technician take FIRST to follow recycling or repurposing best practices while protecting sensitive data?
- A
Perform a full format on each drive and then reinstall the operating system
- B
Use a drive sanitization method that securely wipes the data before donating the systems
- C
Remove the computers from the domain and create new local user accounts for the nonprofit
- D
Delete the user profiles and browser data, then provide the systems with the existing storage drives
Show answer and explanation
Correct answer: B
Explanation
When recycling or repurposing equipment, best practice is to protect organizational and customer data before transfer, donation, resale, or disposal. In this scenario, the systems are being repurposed for reuse, so the correct action is secure data sanitization of the drives rather than simple deletion or formatting. This aligns with common industry guidance such as NIST media sanitization recommendations, which distinguish between clearing, purging, and physical destruction depending on reuse needs and data sensitivity. Because the office handles patient-related records, the technician should prioritize proper sanitization to reduce the risk of data exposure before any reinstallation, account changes, or transfer to the nonprofit.
- A. Incorrect.
A full format is not the best first step when repurposing systems that contained sensitive information. Formatting and reinstalling the OS may not meet secure data disposal expectations because data can remain recoverable depending on the method used. This is a common misconception when preparing devices for donation.
- B. Correct.
This is correct. Before repurposing or donating computers, the technician should use an approved data sanitization method to securely erase the drives. Because the PCs will be reused rather than physically destroyed, secure wiping is the appropriate best practice. This protects regulated and confidential data before the equipment leaves the organization.
- C. Incorrect.
Removing the PCs from the domain may be part of reconfiguration for the next owner, but it does not address the main risk in the scenario: residual patient and identity data on the storage devices. Data protection must be handled first.
- D. Incorrect.
Deleting profiles and browser data is insufficient for systems that stored sensitive records. Files can remain in unallocated space, temporary folders, or other locations on the drive. This option reflects an incomplete cleanup approach rather than proper sanitization.