SY0-701 Question 221
Single answerGeneral data considerationsA healthcare organization is preparing to move several business processes to a third-party SaaS platform. The migration team wants to reduce regulatory exposure and limit the impact of a potential breach before any data is uploaded. The platform does not require personally identifiable patient details for analytics; it only needs broad demographic trends and treatment counts by region. Which action should the security team recommend FIRST to best support this goal?
- A
Tokenize all patient records before uploading them to the SaaS platform
- B
Apply data minimization and send only aggregated, de-identified data required for the analytics use case
- C
Increase the retention period so the SaaS provider can build a more accurate analytics baseline
- D
Label all uploaded records as confidential after transferring the full dataset
Show answer and explanation
Correct answer: B
Explanation
The best answer is to apply data minimization and provide only aggregated, de-identified information needed for the stated business purpose. Under general data security considerations, minimizing data collection, processing, sharing, and retention reduces attack surface and compliance risk. In this scenario, the analytics provider does not need patient-level records, so transferring full records, even if tokenized or labeled, creates unnecessary exposure. This aligns with widely accepted privacy and security practices, including NIST Privacy Framework concepts around data minimization and managing data processing risk, as well as common regulatory expectations such as using the minimum necessary information for a given purpose. Classification and protection mechanisms remain important, but the first and most effective control here is to avoid sharing sensitive data that is not required.
- A. Incorrect.
Tokenization can help protect sensitive fields by replacing them with tokens, and it is useful when the original data may need to be restored later through a secure mapping system. However, in this scenario, the SaaS platform does not need patient-level identifiers at all. Sending tokenized records would still involve transferring more data than necessary and maintaining a token vault or re-identification capability. That does not best satisfy the stated goal of reducing exposure before upload.
- B. Correct.
This is correct. Data minimization is a core security and privacy principle: collect, process, and retain only the data necessary for the business purpose. Because the SaaS platform only needs trend data and counts by region, the organization should provide aggregated, de-identified data rather than full patient-level records. This reduces the sensitivity of the dataset, lowers breach impact, and better aligns with privacy and compliance expectations.
- C. Incorrect.
This is incorrect. Increasing retention generally increases risk because more data is stored for longer, expanding the potential impact of compromise and often increasing compliance obligations. Retention should be limited to business and legal requirements, not expanded unnecessarily for convenience.
- D. Incorrect.
This is incorrect. Data labeling is important for handling requirements and governance, but labeling a full sensitive dataset as confidential after transfer does not reduce the amount or sensitivity of the data disclosed to the third party. The scenario asks for the best first step to reduce exposure before data is uploaded, and minimization addresses that directly.