SY0-701 Question 144
Single answerDecommissioningA company is retiring several virtual and physical servers that previously stored customer records and API keys. The systems will be removed from production this week, and some of the hardware will be returned to a leasing vendor while the virtual machine images will be deleted from the hypervisor cluster. The security administrator must ensure the decommissioning process reduces the risk of data exposure and unauthorized reuse. Which action should the administrator take FIRST?
- A
Perform media sanitization on storage according to the data sensitivity and asset disposition method before releasing the assets
- B
Remove the servers from the asset inventory so they cannot be targeted by future vulnerability scans
- C
Delete the virtual machines from the management console and rely on standard storage reclamation to clear the data
- D
Power off the systems and place them in storage until the leasing vendor requests pickup
Show answer and explanation
Correct answer: A
Explanation
Decommissioning is not just removing an asset from service; it includes securely handling data, preserving accountability, and completing disposition in a controlled manner. In this scenario, the most important first action is media sanitization because the servers contained sensitive customer records and secrets. For leased hardware, sanitization is especially critical before vendor return. For virtual systems, deletion alone is insufficient because snapshots, attached volumes, backups, and shared storage may retain recoverable data. Best practice is to follow documented decommissioning procedures that include approval, backup/retention review, sanitization, inventory updates, chain of custody, and disposal or transfer. NIST SP 800-88 Rev. 1 is a widely referenced source for selecting appropriate sanitization methods such as clear, purge, or destroy based on the media and reuse/disposition requirements.
- A. Correct.
Correct. During decommissioning, the first priority is to ensure residual data cannot be recovered from storage media. For systems containing customer records and API keys, the administrator should apply appropriate media sanitization methods based on the media type, data classification, and whether the asset will be reused, returned, or destroyed. This aligns with decommissioning best practices and guidance such as NIST SP 800-88 Rev. 1 on media sanitization.
- B. Incorrect.
Incorrect. Asset inventory updates are important during decommissioning, but removing systems from inventory before sanitization and disposition can create tracking gaps and reduce accountability. Systems should remain documented until sanitization, chain of custody, and final disposal or transfer are completed.
- C. Incorrect.
Incorrect. Deleting virtual machines from a management console does not guarantee that underlying storage blocks, snapshots, backups, or replicated copies are sanitized. This is a common misconception in virtualized environments. Proper sanitization or secure deletion procedures must be applied at the storage layer and coordinated with retention requirements.
- D. Incorrect.
Incorrect. Simply powering off systems and storing them does not address the primary risk of residual data exposure. Dormant equipment can still be stolen, mishandled, or repurposed without sanitization. Storage may be part of a temporary holding process, but it should occur only under controlled conditions after appropriate decommissioning steps are planned and tracked.