SY0-701 Question 228
Single answerA healthcare company is migrating a customer support application to the cloud. Support agents need to look up patient accounts and verify identity, but the company must reduce the exposure of sensitive data in the application. The compliance team has stated that full credit card numbers must not be stored in the support application database, and agents should only see the last four digits when assisting callers. However, the billing system must still be able to charge the original card when needed. Which method best meets these requirements?
- A
Hash the credit card numbers in the support application database and display the last four digits from the hash value
- B
Encrypt the credit card numbers in the support application database and give all support agents permission to decrypt them when needed
- C
Tokenize the credit card numbers and store the tokens in the support application, while masking the displayed value to show only the last four digits
- D
Obfuscate the credit card numbers before storing them in the support application so the values are not easily readable by administrators
Show answer and explanation
Correct answer: C
Explanation
The best answer is tokenization combined with masking. In this scenario, the company needs to reduce the storage of sensitive payment data in the support application while still allowing a separate billing function to process charges. Tokenization is designed for this use case: the real primary account number is stored in a protected token vault or handled by a tokenization service, while the application stores only a surrogate token. Masking is then used in the user interface so agents can verify identity using only the last four digits without seeing the full card number. By contrast, hashing is one-way and unsuitable for later charging the card, encryption still leaves the sensitive data in scope within the application environment, and obfuscation is not considered sufficient protection for regulated cardholder data. This aligns with common PCI DSS practices that emphasize minimizing storage of cardholder data, restricting access based on business need-to-know, and rendering displayed account numbers unreadable except for limited digits where appropriate.
- A. Incorrect.
Incorrect. Hashing is a one-way operation and is useful for integrity verification or password storage, not for retrieving the original card number for future payment processing. Also, you cannot reliably display the real last four digits from a hash because the hash output is not a reversible representation of the original number.
- B. Incorrect.
Incorrect. Encryption protects data at rest, but this option still stores the actual credit card numbers in the support application's database, which does not satisfy the requirement to avoid storing full card numbers there. In addition, granting all support agents the ability to decrypt the values violates least privilege and unnecessarily increases exposure of cardholder data.
- C. Correct.
Correct. Tokenization replaces the real credit card number with a non-sensitive token in the support application, reducing exposure if that system is compromised. Masking ensures support agents only view the last four digits, which is a common business and compliance requirement. The billing system can use the tokenization system or vault to map the token back to the original card number for authorized payment processing.
- D. Incorrect.
Incorrect. Obfuscation may make data harder to interpret, but it is not a strong control for protecting regulated payment data and typically does not provide the secure separation required for cardholder data. Unlike tokenization, obfuscation does not reliably support secure retrieval and authorized reuse of the original payment card number.