SY0-701 Question 229
Single answerA retail company is modernizing its e-commerce environment after an internal audit found that customer payment data was being exposed to too many internal systems. Customer support representatives need to view records to verify purchases, but they do not need access to full card numbers. The payment processing application must still be able to charge cards, and the company wants to reduce the impact of a database breach by ensuring stolen records cannot be directly used for purchases. Which solution BEST meets these requirements?
- A
Apply tokenization to stored card data and display only masked card numbers to customer support staff
- B
Hash all card numbers in the database and allow the payment processor to compare hashes during transactions
- C
Obfuscate the card number field in the database and grant all support staff read access for troubleshooting
- D
Encrypt the entire customer database with a single shared key and provide the key to support staff when they need to verify purchases
Show answer and explanation
Correct answer: A
Explanation
The best answer is tokenization combined with masking because it addresses both security and operational needs. Tokenization reduces the presence of sensitive cardholder data across the environment by substituting tokens for actual PANs, which can significantly reduce the usefulness of stolen records in a breach. Masking supports customer service workflows by showing only the minimum necessary data, such as the last four digits. This approach follows the principle of least privilege and data minimization.
Hashing is not suitable when the original value must be used later, such as for payment authorization. Obfuscation is not a primary protection mechanism for sensitive financial data. Encryption is an important control for data at rest and in transit, but it must be paired with strong key management and permission restrictions; broadly distributing decryption keys undermines the control.
These practices are consistent with common security guidance and industry expectations, including PCI DSS concepts around rendering account data unreadable, restricting access by business need to know, and displaying masked PANs when full card numbers are not required.
- A. Correct.
Correct. Tokenization replaces the primary account number (PAN) with a non-sensitive token, which reduces the exposure of usable payment card data in internal systems. Masking ensures customer support staff see only limited portions of the card number, such as the last four digits, which is sufficient for verification without exposing the full PAN. This combination aligns well with payment-data protection practices because the payment application can use the tokenization system to retrieve or process the underlying card data when authorized, while most staff and systems never handle the actual PAN.
- B. Incorrect.
Incorrect. Hashing is useful for integrity verification and for comparing fixed values such as passwords, but it is not appropriate for data that must later be retrieved or used in its original form for payment processing. Standard hashing is one-way, so the processor cannot charge a card using only a hash of the PAN. Someone might choose this because hashing sounds like a strong protection method, but it does not support the business requirement to process payments.
- C. Incorrect.
Incorrect. Obfuscation makes data harder to understand or read casually, but it is not a strong control for protecting regulated payment card data. It does not provide the same security value as tokenization or properly implemented encryption, and granting all support staff read access violates least privilege. This option reflects a common misconception that making data look different is enough to secure it.
- D. Incorrect.
Incorrect. Encryption protects data at rest, but this option fails because giving the decryption key broadly to support staff defeats the purpose of encryption and violates permission restrictions and least-privilege principles. In addition, a single shared key for broad access creates key-management and accountability problems. A candidate might pick this because encryption is generally correct for protecting sensitive data, but the access model described is insecure.