Reissuing Laptops: Sanitization and Certification

SY0-701 By islever Editorial Last updated

Explain the security implications of proper hardware, software, and data asset management. Compare and contrast concepts and strategies to protect data.

Short answer

BE Certification and Sanitization ensure data is securely removed and verified before the laptop is reused.

Question

A security administrator is reissuing a former employee's laptop. Which of the following is the best combination of data handling activities for the administrator to perform? (Choose two.)
  1. Data retention
  2. Certification Correct Answer
  3. Destruction
  4. Classification
  5. Sanitization Correct Answer
  6. Enumeration

Key Takeaways

The trap is choosing Destruction (for disposal) instead of Sanitization (for reuse), and forgetting Certification as the necessary verification step.

Learn why certification and sanitization are the required steps for reissuing a former employee's laptop to ensure data security.

Common mistake: Choosing Destruction because it sounds more 'secure', but this applies to disposal, not reissuing assets.

Expert Analysis

Data Lifecycle and Asset Reuse When reissuing a laptop, the primary security objective is to prevent data leakage from the former employee while preserving the asset's value. This requires removing residual data without destroying the hardware.

Sanitization (E) Sanitization is the correct first step. It involves securely wiping or overwriting data so it cannot be recovered by standard means. For a hard drive or SSD that will remain in the device, sanitization is the standard procedure to make the device 'clean' for the new user.

Certification (B) Certification is the correct second step. After sanitization, the organization must formally document and verify that the process was successful. This 'certification' provides an audit trail proving the data is gone, which is critical for compliance and accountability before the asset changes hands.

Why Other Options Fail

  • Destruction (C): This is used when decommissioning or disposing of an asset. Since the laptop is being reissued, destroying the storage media would defeat the purpose of reuse.
  • Data Retention (A): While retention policies exist, they dictate what data to keep before wiping. The question asks for handling activities related to the device reissue. You do not 'retain' data on the device you are wiping; you may retain records off-device, but that is not the immediate physical handling activity for the laptop itself.
  • Classification (D): Classification happens long before reissue. It determines sensitivity levels but does not actively secure the device for the next user.
  • Enumeration (F): This is a reconnaissance technique, irrelevant to data handling.

Exam Strategy

Always distinguish between 'Disposal' and 'Reuse'. If an asset is being discarded, look for Destruction. If it is being moved to another user or department, look for Sanitization followed by Certification. Read the scenario verb carefully: 'reissuing' implies continued use, ruling out destructive methods.

Frequently Asked Questions

What is the difference between sanitization and destruction?

Sanitization removes data so it cannot be recovered but keeps the storage media intact. Destruction physically destroys the media, making recovery impossible but rendering the device unusable.

Why is Certification important after sanitization?

Certification provides documented proof that the sanitization process was completed successfully. It creates an audit trail for compliance and legal requirements.

More SY0-701 FAQ →

Community Votes

BE
63%
BC
17%
AE
20%

63% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 54 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 54

  1. cf83993 👍 38
    Bro you don't reissue something after you destroy it do you? We're talking about a laptop here not an ex ;)
  2. Th3irdEye 👍 33
    Destruction would make the device not usable again. Certification might make sense here if a third party was being used to sanitize the drive but usually third parties are used to destroy drives and certification is given for destruction. I think Data retention and Sanitization makes the most sense. You want to make sure you save any critical data before you erase the drive.
  3. Ty13 👍 7
    Retention and Sanitize. Think about it. An employee leaves - you backup any pertinent company data (Retention) and reimage the computer (Sanitize). - You would not Certify it, because that's only if the drive needed to be destroyed. - You would not Destroy it because that's really only important for sensitive things, not Judy the Customer Service agent. - You would not Enumerate it (gathering info for vulnerabilities) - Classification is typically more important for data rather than devices.
  4. ProudFather 👍 5
    To ensure the security of the data, the administrator should: Destruction: Physically destroy any storage media that cannot be sanitized. Sanitization: Thoroughly erase or overwrite all data on the storage media to prevent data recovery. The other options are not relevant to the scenario: Data retention: This involves keeping data for a specific period. It's not applicable in this case as the data needs to be removed. Certification: This is a process of verifying that a system or process meets specific standards. It's not relevant to data handling in this context. Classification: This involves assigning security labels to data based on its sensitivity. It's not necessary in this case as the data is being removed. Enumeration: This involves identifying and cataloging assets. It's not relevant to data handling in this context.
  5. baronvon 👍 5
    A and E Sanitization refers to the process of removing or cleaning data from a device to ensure that it cannot be recovered by unauthorized individuals. This typically includes methods such as wiping or formatting the storage media While decommissioning and disposal are important, organizations often have to retain data or systems as well. Retention may be required for legal purposes with set retention periods determined by law, or retention may be associated with a legal case due to a legal hold
Show 25 more comments
  1. d2087a6 👍 5
    To safely reissue the laptop, the administrator should sanitize the device to remove all data securely. If sanitization isn’t sufficient for highly sensitive data, destruction of the storage medium may be required.
  2. dbrowndiver 👍 4
    When reissuing a laptop, it's crucial to ensure that all previous data is irretrievably removed, and the device is clean and secure for the next user. Destruction and Sanitization are two key processes involved in handling data securely in this context. Opt. C. Destruction: This process involves permanently destroying data so it cannot be recovered. It is often used when data is no longer needed and must be securely eliminated. Destruction is crucial to prevent data leakage or unauthorized access to old data. It provides peace of mind that the data is gone and cannot be retrieved. Opt.E. Sanitization: This process involves cleaning a device to remove data and make it safe for reuse. Techniques include overwriting, degaussing, and cryptographic erasure. Preparing for Reuse: Sanitization makes sure that all traces of previous data are removed, and the device is in a clean state, ready for new usage. Sanitization ensures that any residual data from the former employee is thoroughly erased, making the laptop safe and secure for the next user.
  3. Konversation 👍 4
    Since the question does not refer a third-party but to the "internal" administrator and following the CompTIA theoretical questions it's A & E. E. Sanitization. This is clear. A. Data retention. The CompTIA Student Guide and WBT refer to the "Data retention" in the "Secure Data Destruction" chapter. B. Certification is used by CompTIA only for third-party "Asset Disposal". But a third-party is not mentioned in the question. "certification - An asset disposal technique that relies on a third party to use sanitization or destruction methods for data remnant removal, and provides documentary evidence that the process is complete and successful." C. Destruction - CompTIA defines this as "Physical destruction methods include shredding, crushing ..." This is also not the case for this question.
  4. ETQ 👍 4
    No, it doesn't mean that at all. If it did, sanitizing after "destroying the data" would be useless. Destruction refers to destroying the drive, which you do when you actually dispose of the machine, not when you reissue it. You need to sanitize the drive and certify that you did.
  5. AutoroTink 👍 4
    You can't reissue a laptop if you've destroyed it. It does need to be sanitized, and then certified that the sanitization was complete and G2G.
  6. 0ca8ee9 👍 4
    Sanitization - cleaning the laptop memory Certification - proving that the laptop is clean.
  7. 123456789User 👍 4
    C: Sanitize by removing all data from the laptop. E: Destroy the physical storage drive.
  8. 1chung 👍 4
    Corrrect Answer is CE
  9. pedrwc7 👍 3
    A. Data retention • retain data B. Certification • Audit log of either Sanitization, Disposal or Destruction C. Destruction •Destruction is goes beyond Sanitization ensures physical devices is unusable. It means you destroy it in pieces. D. Classification • Base on value and sensitivity of the data. E. Sanitization • Sanitization is thorough process to ensure the data is inaccessible and irretrievable, however, it can be reuse. F. Enumeration •
  10. AndyK2 👍 3
    C. Destruction > ensures physical media is rendered unrecoverable E. Sanitization > removes and overwrites sensitive data to prevent unauthorized access. Both used to protect data security when repurposing hardware.
  11. ETQ 👍 3
    "Hey user, here's your laptop that I just destroyed, now chopchop, get to work!"
  12. Hayder81 👍 3
    B, E it's being reused. So, you need to sanitize and certify
  13. Russell15 👍 3
    You cant reuse something after destroying it?
  14. 3dk1 👍 3
    Th3irdEye explains my thinking
  15. koala_lay 👍 3
    Agree to answer B E
  16. nillie 👍 2
    The best combination of data handling activities for the administrator to perform when reissuing a former employee's laptop are: C. Destruction and E. Sanitization Destruction: Ensures that any sensitive or personal data from the previous user is permanently removed and cannot be recovered. Sanitization: Refers to thoroughly cleaning the device by securely wiping the data to prevent unauthorized access. This prepares the laptop for safe reissue to a new user. These two activities are critical for preventing any sensitive data leakage from the former employee while ensuring that the device is clean and secure for the next user.
  17. 5a5837f 👍 2
    from experience i can say reissuing a laptop can involve replacing old drive with a new ssd before reissue. For a reissued laptop, the key goal is to make sure the former employee’s data is no longer recoverable before the device is given to someone else. In the Security+ study guide from sybex, the decommissioning section says organizations must ensure that no sensitive data remains on the system, and that when a drive is being reused, it should be securely wiped. It then states that sanitizing drives or media involves one of two processes: wiping the data or destroying the media.
  18. 5a11b63 👍 2
    C. Destruction Why? Ensures sensitive data (e.g., personal files, credentials) is irrecoverably destroyed before reuse. Methods: Physical destruction (shredding drives) or cryptographic erasure for SSDs. E. Sanitization Why? Removes all data beyond recovery (e.g., via NIST SP 800-88 standards: wiping, degaussing, or secure erase). Prepares the device for safe reuse without residual data leaks.
  19. SHADTECH123 👍 2
    E. Sanitization: This involves removing or destroying sensitive information from the laptop to ensure that the data cannot be accessed by unauthorized individuals. B. Certification: After sanitizing the laptop, the administrator should certify that the sanitization process has been completed successfully.
  20. adderallpm 👍 2
    Destruction renders the device unusable does it no? And you only need a certification after destruction from a third-party? So in reality, you would just want to back up the data and then make sure to overwrite the hard drive a couple times so that, that data can’t be recovered. 🫶🏻
  21. 5a5837f 👍 2
    Exam takeaway: For old laptops, retired drives, reassigned endpoints, or decommissioned media, think first of: Sanitization = securely wipe the data Destruction = physically destroy the media when reuse is not needed So the best two answers are C. Destruction and E. Sanitization.
  22. dbrowndiver 👍 2
    Data destruction involves securely deleting sensitive information so it cannot be recovered. Before reissuing a laptop, it is critical to ensure that any residual data from the previous user is permanently removed to prevent unauthorized access to sensitive information.
  23. MikelMiguel 👍 2
    Its Destruction and Sanitation. This is because the laptop is been reissued and because they question did not say reissued to the "same employee" then we have to assume is been intended to be reissued for a new or another employee. therefore D&E is the answer
  24. e56400d 👍 2
    I just did a large laptop resale at my company. In order to sell our old user's company laptops we had the wipe/sanitize the data and provide the certificate that the computer is wipe.
  25. MikelMiguel 👍 2
    Reissue doesn't mean to the same employee. It could be to another employee in Shipping department. So why not destroy and sanitize account department laptop before reissuing.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide