SY0-701 Question 39
Select 2Obfuscation: Steganography , Tokenization , Data maskingA healthcare company is modernizing its patient billing platform. Developers need to let customer service representatives search records by the last four digits of a payment card, while ensuring the live application does not store actual card numbers in its database. At the same time, the training team needs realistic-looking patient reports for a staging environment without exposing real patient identifiers or payment data. Which TWO controls best meet these requirements?
- A
Implement tokenization for payment card numbers in the production billing application and store the mapping securely outside the application database
- B
Use steganography to hide full payment card numbers inside image files attached to patient records so the database does not directly contain the numbers
- C
Apply data masking to copies of patient and payment records before they are loaded into the staging environment
- D
Encrypt the production database and give customer service representatives access to the decryption keys so they can search by card number suffix
- E
Hash payment card numbers with a random salt and use the salted hashes to support direct searches by the last four digits
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are tokenization for production card data and data masking for staging data. Tokenization is widely used for payment card information because it replaces the sensitive PAN with a token and stores the original value in a separate protected system, reducing the spread of cardholder data across the environment. Data masking is the correct choice for training and test environments because it preserves realistic structure without exposing real patient or payment information. Steganography is an obfuscation technique, but it is not an appropriate control for storing regulated business data in production systems. Best practices reflected here align with PCI DSS guidance for minimizing cardholder data exposure and common secure-development practices for using masked data in nonproduction environments.
- A. Correct.
Correct. Tokenization replaces sensitive data such as PANs with nonsensitive tokens, while the real values are kept in a separate, secured token vault or mapping system. This allows the production application to avoid storing actual card numbers in its primary database. In payment environments, tokenization is commonly used to reduce exposure of cardholder data and support business processes without retaining the original value in most systems.
- B. Incorrect.
Incorrect. Steganography hides data within another file or medium, such as embedding information in an image, but it does not meaningfully reduce sensitivity or provide appropriate protection for payment card data in an enterprise application. It would also create serious manageability, compliance, and security issues. Someone might choose this because it sounds like a way to conceal data, but concealment is not the same as secure handling or proper obfuscation for operational systems.
- C. Correct.
Correct. Data masking is appropriate for nonproduction environments such as staging, testing, or training, where realistic-looking data is needed but the original sensitive values should not be exposed. Masking can preserve format and usability while preventing trainees or developers from seeing actual patient identifiers or payment details.
- D. Incorrect.
Incorrect. Database encryption protects data at rest, but giving customer service representatives decryption keys broadly increases risk and does not satisfy the requirement to avoid storing real card numbers in the live application database. This option also confuses encryption with obfuscation techniques used to minimize sensitive-data exposure. A candidate might pick it because encryption is important, but it is not the best fit for this use case.
- E. Incorrect.
Incorrect. Salted hashing is designed for one-way protection, commonly for passwords, and is not suitable for recovering or operationally using payment card numbers. It also does not support practical searching by last four digits in the way described, because the application needs a controlled method to associate a tokenized record with display or business logic. This distractor targets the misconception that hashing can replace all forms of sensitive-data handling.