Study. uk . com
  1. Home
  2. All questions
  3. Question 168

CISSP study material · question 168 of 500

A drive is labelled as 1 terabyte, but its controller performs internal compression and holds additional physical capacity. What does NIST SP 800-88 Rev. 2 conclude about sanitizing it?

  1. The drive must be destroyed, since the true capacity cannot be determined.
  2. The drive must be sanitized twice, once per addressing scheme.
  3. Only the advertised capacity need be sanitized, as the remainder is inaccessible.
  4. The whole contents must be sanitized, since user data may sit outside the advertised capacity.
Show the answer

Answer: D. The whole contents must be sanitized, since user data may sit outside the advertised capacity.

Where mechanisms such as overprovisioning or internal data reduction mean user data may reside beyond the advertised capacity, the entire contents of the media should be sanitized.

Source: NIST SP 800-88 Rev. 2 (NIST) — SP 800-88 Rev. 2 > 2.3 Media Capacity

Challenge yourself on this topic → Study as cards