CAS-003 · Question #272
Company XYZ plans to donate 1,000 used computers to a local school. The company has a large research and development section and some of the computers were previously used to store proprietary…
The correct answer is B. Delay the donation until all storage media on the computers can be sanitized. The absence of a sanitization policy does not eliminate the legal or ethical obligation to protect proprietary data. The security administrator's responsibility is to ensure data is securely removed before any machines leave company control. Delaying the donation until all…
Question
Company XYZ plans to donate 1,000 used computers to a local school. The company has a large research and development section and some of the computers were previously used to store proprietary research. The security administrator is concerned about data remnants on the donated machines, but the company does not have a device sanitization section in the data handling policy. Which of the following is the BEST course of action for the security administrator to take?
Options
- ADelay the donation until a new policy is approved by the Chief Information Officer (CIO),
- BDelay the donation until all storage media on the computers can be sanitized.
- CReload the machines with an open source operating system and then donate the machines.
- DMove forward with the donation, but remove all software license keys from the machines.
How the community answered
(23 responses)- A17% (4)
- B74% (17)
- C4% (1)
- D4% (1)
Explanation
The absence of a sanitization policy does not eliminate the legal or ethical obligation to protect proprietary data. The security administrator's responsibility is to ensure data is securely removed before any machines leave company control. Delaying the donation until all storage media is properly sanitized (wiped or degaussed per standards like NIST 800-88) is the only option that directly addresses the data remnant risk. Option A wastes time waiting on policy when the right action is already clear. Option C (reloading the OS) does not overwrite deleted files recoverable via forensic tools. Option D (removing license keys) does nothing to address proprietary data on the drives.
Topics
Community Discussion
No community discussion yet for this question.