220-1102 Question 724
Single answerProper disposal of other devices and assetsA company is replacing several multifunction printers and VoIP desk phones at the end of a lease. The devices will be returned to the leasing vendor, and management wants to reduce the risk of exposing company information stored on the equipment. Which action should the technician take FIRST before the devices leave the building?
- A
Remove all asset tags and send the devices back immediately because leased equipment remains the vendor's responsibility
- B
Perform a factory reset or sanitization procedure on each device to clear stored data and settings, then document the disposition
- C
Physically destroy the devices' storage components with a drill so no data can be recovered
- D
Unplug the devices from the network and power them off for 24 hours to allow volatile memory to clear
Show answer and explanation
Correct answer: B
Explanation
The best answer is to sanitize the devices using the manufacturer's supported reset or data-clearing process before they are transferred outside the organization's control. This aligns with standard security practice for proper disposal of other devices and assets, not just PCs and drives. Multifunction printers often contain internal storage that can retain scanned documents, print jobs, email settings, and authentication details. VoIP phones may retain directory entries, SIP credentials, call history, and network configuration. Best practices include following organizational disposal policy, using documented vendor sanitization procedures, and recording the asset disposition. This approach is consistent with common guidance such as NIST SP 800-88 Rev. 1 for media sanitization principles, while also respecting lease requirements and maintaining auditability.
- A. Incorrect.
Incorrect. Even though the equipment is leased, the company is still responsible for protecting any data stored on the devices before transfer. Printers and VoIP phones can retain address books, call logs, cached credentials, network settings, scan destinations, and in some cases stored documents. Removing asset tags may be part of the return process, but it does not address data sanitization.
- B. Correct.
Correct. Before disposal, return, or redeployment, devices that may store organizational data should be sanitized according to vendor-supported procedures. For multifunction printers and VoIP phones, this commonly means performing a factory reset, secure erase, or other documented sanitization step to remove stored settings and data. Documenting the disposition supports chain-of-custody, inventory control, and compliance with company policy.
- C. Incorrect.
Incorrect. Physical destruction is appropriate for company-owned media that is being permanently disposed of and cannot be securely sanitized, but it is not the first or best step for leased devices that must be returned to the vendor. Destroying leased hardware would likely violate the lease agreement and is unnecessary if approved sanitization methods exist.
- D. Incorrect.
Incorrect. Powering a device off or disconnecting it from the network only affects volatile memory and active connectivity. It does not reliably remove nonvolatile data stored in flash memory, internal drives, or configuration storage. A candidate might choose this because it sounds like a simple security step, but it does not meet disposal or return sanitization requirements.