N10-009 Question 197
Select 2A company is replacing several branch-office routers after the vendor announced the hardware is end-of-life (EOL). The routers still power on and pass traffic, but the vendor has also declared the installed operating system version end-of-support (EOS), and no additional security patches or bug fixes will be released. Before sending the old routers to an electronics recycler, the network administrator must reduce security risk and follow proper life-cycle management practices. Which TWO actions should the administrator take first?
- A
Back up any needed configurations, document the retirement, and securely erase the startup configuration, keys, and stored credentials from each router
- B
Keep the routers in production until a critical failure occurs, since EOL hardware can still function normally
- C
Upgrade the devices to a currently supported firmware/OS release if one exists, then decommission them according to company policy
- D
Skip sanitization because the recycler will handle disposal, and focus only on physically removing the devices from the rack
- E
Disable logging on the routers before removal so stored events cannot be used by an attacker
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to securely back up/document and sanitize the devices, and to keep software supported and patched during the transition if a supported release is available. In life-cycle management, EOL means the product is no longer sold or manufactured, while EOS means the vendor no longer provides updates, patches, or technical support. From a risk perspective, EOS is especially important because unsupported operating systems and firmware can leave known vulnerabilities uncorrected. Industry best practices for decommissioning network equipment include inventory tracking, change documentation, configuration backup when needed, credential and key removal, secure wiping/resetting of nonvolatile storage, and disposal through approved processes. These practices align with common vendor guidance for router and switch retirement and with general media sanitization principles such as those described by NIST SP 800-88 for sanitization planning.
- A. Correct.
Correct. Proper decommissioning includes preserving any information the organization still needs, such as configurations for migration, audit, or rollback reference, while also sanitizing the device before disposal. On network equipment, that means securely removing saved configurations, local accounts, SSH keys, certificates, SNMP community strings, VPN settings, and other credentials. Documenting the retirement supports asset tracking and life-cycle management.
- B. Incorrect.
Incorrect. A device can remain operational after EOL, but that does not make continued production use a good risk decision, especially when the software is already EOS and no longer receives security patches or bug fixes. Waiting for failure increases outage risk and leaves the organization exposed to unpatched vulnerabilities.
- C. Correct.
Correct. If the vendor offers a supported firmware or OS release for the hardware, applying it before retirement can reduce exposure during the transition period. This aligns with software management best practices: maintain supported OS/firmware versions and patch where possible. After migration, the devices should still be formally decommissioned according to policy rather than simply discarded.
- D. Incorrect.
Incorrect. Sanitization is the organization's responsibility, not something that should be assumed to occur at the recycler. Network devices often retain sensitive data in nonvolatile storage. Removing the hardware without clearing that data creates a security risk even if the device is no longer in service.
- E. Incorrect.
Incorrect. Disabling logging does not remove stored credentials or configuration data and does not meaningfully address the primary decommissioning risk. In some environments, logs may actually be needed for audit or troubleshooting during the migration. The key task is configuration backup as needed and secure sanitization of the device.