220-1102 Question 828
Single answerData privacyA technician is preparing to repurpose several company laptops for a new department. The laptops were previously assigned to employees in Human Resources and contain files with Social Security numbers, salary information, and performance reviews. Company policy requires that no recoverable employee data remain on the devices before reassignment. Which action should the technician take FIRST to best protect data privacy?
- A
Perform a standard quick format on each drive and reinstall the operating system
- B
Delete the user profiles and empty the Recycle Bin before creating new accounts
- C
Use an approved data sanitization method to securely wipe the drives, then reinstall the operating system
- D
Rename the existing HR folders and restrict access using NTFS permissions
Show answer and explanation
Correct answer: C
Explanation
The best first step is to securely sanitize the drives before reusing the laptops. In an A+ Core 2 context, protecting data privacy means ensuring sensitive information is not merely hidden or access-restricted, but actually removed in a way that prevents recovery. This is especially important for HR data containing personally identifiable information (PII). Industry best practices, including guidance from NIST SP 800-88 Rev. 1 on media sanitization, distinguish between ordinary deletion/formatting and proper sanitization methods designed to prevent data recovery. Quick formats, file deletion, and permission changes do not meet the requirement when devices are being repurposed and confidential data must not remain recoverable.
- A. Incorrect.
A quick format does not securely remove existing data; it primarily resets file system structures and leaves much of the underlying data potentially recoverable with forensic or recovery tools. A candidate might choose this because formatting sounds thorough, but for data privacy requirements involving sensitive HR records, it is not sufficient.
- B. Incorrect.
Deleting profiles and emptying the Recycle Bin only removes references to the files from the operating system and does not ensure the data is unrecoverable. This is a common misconception because deleted data appears to be gone to the user, but it can often still be recovered unless the drive is properly sanitized.
- C. Correct.
This is correct. Sensitive personal information such as Social Security numbers and salary records requires secure data sanitization before reassignment of the devices. Using an approved wipe or sanitization process helps ensure the previous data cannot be recovered, which directly supports data privacy requirements. After sanitization, reinstalling the operating system prepares the laptops for the next users.
- D. Incorrect.
Restricting access with permissions may prevent casual access, but it does not remove the confidential data from the laptops. Since the devices are being reassigned, the requirement is to ensure no recoverable employee data remains. Permissions are an access-control measure, not a data-removal or sanitization measure.