When Should an Engineer Decommission a Network Device?

SY0-701 By islever Editorial Last updated

Explain the security implications of proper hardware, software, and data asset management. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

BE Recommend decommissioning when a network device uses cleartext passwords or its encryption level cannot meet organizational standards.

Question

Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Choose two.)
  1. The device has been moved from a production environment to a test environment.
  2. The device is configured to use cleartext passwords. Correct Answer
  3. The device is moved to an isolated segment on the enterprise network.
  4. The device is moved to a different location in the enterprise.
  5. The device's encryption level cannot meet organizational standards. Correct Answer

Key Takeaways

The question tests whether you can separate security-driven permanent retirement from simple relocation, isolation or repurposing, and the trap is choosing the movement options that keep an insecure device in service.

Decommissioning a network device is the correct recommendation when the device cannot meet security requirements, such as being configured with cleartext passwords (B) or having an encryption level below organizational standards (E). This page confirms the two-letter answer and explains why relocating or isolating a device is not a decommissioning case.

Common mistake: The most common mistake is picking only option E because the source key shows one letter, or choosing options such as moving the device to a test environment, an isolated segment or a new location — all of which redeploy the device instead of retiring it.

Expert Analysis

Why the Answer Is Correct

Decommissioning is a permanent asset-management decision, so an engineer should only recommend it when the device cannot be brought up to the organization's security baseline. Option B describes a device configured to use cleartext passwords, a credential-exposure weakness that violates the secure-configuration baseline and, where the platform cannot support encrypted management, cannot simply be patched away. Option E describes a device whose encryption strength cannot meet organizational standards, which is a control failure that no reconfiguration can repair. Both conditions leave the organization with an unresolvable risk, so B and E are the two options that justify permanent retirement. Every other option describes moving, isolating or repurposing the device while it remains in service.

Why the Other Options Are Wrong

Option A, moving a device from production to a test environment, is redeployment, not decommissioning; the same hardware continues to operate, usually after being sanitized or reconfigured. Option C, placing the device on an isolated segment, is a containment technique used to limit exposure to a risky asset while still using it. Option D, relocating a device within the enterprise, is pure physical relocation and has no bearing on whether the device should be retired. None of these three actions removes the asset, so none of them answers a question that asks specifically about decommissioning.

Community Comment Notes

Several learners argued for pairing option E with a sixth choice about a device that is unable to receive authorized updates, as Etc_Shadow28000 and dbrowndiver did, but that option is not present in this version of the question, so it cannot be selected. Others concluded that the real second trigger is cleartext passwords, including Innana, who wrote that the "Correct answers are B and E", and Fontabest_99a, who also answered B and E. Jamie888 noted that a Practice test in Pluralsight says "its B and E", which matches the same pairing, and ProudFather framed cleartext passwords and insufficient encryption as the two unacceptable security risks. The general agreement is that relocation or isolation options are red herrings because the device stays in operation.

Official Reference

https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a multi-select asks for decommissioning cases, filter the options by asking whether the device can be remediated in place; if it cannot, retirement is the recommended control. Movement, isolation and reuse options keep the asset alive and should be eliminated first.

Frequently Asked Questions

Why isn't moving a device to an isolated segment a decommissioning case?

Isolating a device on a separate segment is a containment control that limits exposure while the device is still in use; decommissioning permanently removes the asset, so only unresolvable security failures justify it.

Why do some learners mention an option about devices that cannot receive updates?

A related build of this question listed a choice about a device unable to receive authorized updates; that option is not offered here, so the security-driven picks among A-E are B and E.

More SY0-701 FAQ →

Community Votes

BE
100%

100% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Etc_Shadow28000 👍 7 Answered E
    E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates. These two cases justify decommissioning a network device: - Encryption Level: If a device's encryption level cannot meet the organization's standards, it poses a significant security risk and should be decommissioned. - Authorized Updates: If a device is unable to receive authorized updates, it becomes vulnerable to known exploits and cannot be maintained securely, thus it should also be decommissioned. Therefore, the correct answers are: E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates.
  2. dbrowndiver 👍 4 Answered E
    When evaluating whether a network device should be decommissioned, security vulnerabilities, compliance with organizational standards, and the ability to maintain the device are critical considerations. Options E and F highlight situations where a device is not able to meet these essential requirements. E. The device's encryption level cannot meet organizational standards and F. The device is unable to receive authorized updates are the correct reasons for recommending the decommissioning of a network device. These conditions indicate significant security and compliance risks that cannot be addressed through reconfiguration alone, necessitating the removal of the device to protect the organization's network and data.
  3. Shaman73 👍 3
    • E. The device's encryption level cannot meet organizational standards. • F. The device is unable to receive authorized updates
  4. G3O 👍 2 Answered E
    E. The device's encryption level cannot meet organizational standards F. The device is unable to receive authorized updates
  5. Jamie888 👍 2
    Practice test in pluralsight say its B and E
Show 4 more comments
  1. ProudFather 👍 1
    B. The device is configured to use cleartext passwords. E. The device's encryption level cannot meet organizational standards. These two options represent situations where the device poses a significant security risk: Cleartext passwords: Devices with cleartext passwords are vulnerable to unauthorized access and data breaches. Insufficient encryption: Devices that cannot meet organizational encryption standards may not be able to protect sensitive data adequately. The other options do not necessarily warrant decommissioning:
  2. jennyka76 👍 1 Answered E
    An engineer should recommend decommissioning a network device primarily when security risks are high, such as if the device's encryption level is insufficient for organization standards or if it cannot receive necessary security updates, or when it's no longer in active use.
  3. Innana 👍 1
    Correct answers are B and E. While F is also a good alternative but not good enough as B and E
  4. Fontabest_99a 👍 1
    B And E

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

What Risk Does Opening Firewall Ports for a SaaS System Introduce?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide