nerdexam
CompTIA

CAS-002 · Question #238

Part of the procedure for decommissioning a database server is to wipe all local disks, as well as SAN LUNs allocated to the server, even though the SAN itself is not being decommissioned. Which of…

The correct answer is C. Data remnants remain on the LUN that could be read by other servers. SAN LUNs must be wiped during server decommissioning because the underlying storage blocks retain data that could be accessed by the next server allocated to those LUNs.

Enterprise Security

Question

Part of the procedure for decommissioning a database server is to wipe all local disks, as well as SAN LUNs allocated to the server, even though the SAN itself is not being decommissioned. Which of the following is the reason for wiping the SAN LUNs?

Options

  • ALUN masking will prevent the next server from accessing the LUNs.
  • BThe data may be replicated to other sites that are not as secure.
  • CData remnants remain on the LUN that could be read by other servers.
  • DThe data is not encrypted during transport.

How the community answered

(53 responses)
  • B
    4% (2)
  • C
    94% (50)
  • D
    2% (1)

Why each option

SAN LUNs must be wiped during server decommissioning because the underlying storage blocks retain data that could be accessed by the next server allocated to those LUNs.

ALUN masking will prevent the next server from accessing the LUNs.

LUN masking controls which host bus adapters can access which LUNs at the storage fabric layer, but it is an access control mechanism and does not remove or destroy the data residing on the LUN.

BThe data may be replicated to other sites that are not as secure.

Data replication to remote sites is a separate operational concern and is not the primary reason to wipe LUNs during local server decommissioning.

CData remnants remain on the LUN that could be read by other servers.Correct

When a LUN is deallocated from a decommissioned server and later reallocated to a new server, all previously written data blocks remain physically on the storage until overwritten - a newly assigned server can read that residual data, creating a direct data leakage risk that requires sanitization to eliminate.

DThe data is not encrypted during transport.

Encryption in transit protects data moving across the storage network but has no effect on data already at rest on the LUN after the server has been decommissioned.

Concept tested: SAN LUN data remnant risk and sanitization

Source: https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final

Topics

#data remanence#SAN#decommissioning#data sanitization

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice