SY0-701 Question 40
Single answerObfuscation: Steganography , Tokenization , Data maskingA retail company is moving payment processing to a third-party cloud application. Developers need realistic data in lower environments for testing customer service workflows, but the company must reduce the exposure of primary account numbers (PANs) and other sensitive customer data. Customer service representatives in production still need to search records by the last four digits of a card number, and the payment processor must be able to map submitted values back to the original PAN during authorized transactions. Which solution BEST meets these requirements?
- A
Use tokenization for stored PANs and configure displays to show only masked values such as the last four digits
- B
Use steganography to hide PANs inside image files before sending them to the cloud application
- C
Use full data masking in production databases so the original PAN is never retained anywhere in the environment
- D
Hash PANs with a one-way algorithm and allow customer service to reverse the hash when needed for transactions
Show answer and explanation
Correct answer: A
Explanation
The best answer is tokenization combined with masked display. In this scenario, the organization has two distinct needs: reduce exposure of sensitive payment data and still preserve operational use. Tokenization is well suited because it substitutes the PAN with a token that has no exploitable value if exposed, while an authorized token vault or service can map the token back to the original PAN when needed for legitimate payment processing. Data masking is also relevant, but primarily for non-production use cases where realistic-looking data is needed without exposing live customer data. Masking by itself does not typically provide the reversible mapping required for payment operations. Steganography is an obfuscation technique but is not a practical or standard control for protecting structured payment records in enterprise systems. These distinctions are consistent with Security+ objectives and with industry best practices such as PCI DSS guidance emphasizing minimization of stored account data, rendering PAN unreadable where stored, and limiting display of PAN to only what is necessary, often the last four digits.
- A. Correct.
Correct. Tokenization replaces sensitive data such as PANs with non-sensitive surrogate values (tokens), reducing the exposure of cardholder data in applications and databases. Display masking can then be used so users only see limited portions, such as the last four digits, which supports customer service workflows while protecting full account numbers. This approach aligns with common PCI DSS practices for minimizing stored cardholder data exposure while preserving business functionality.
- B. Incorrect.
Incorrect. Steganography is the practice of hiding data within another file or medium, such as embedding information in an image or audio file. It is not an appropriate control for protecting payment card data in business applications, does not support standard search and transaction workflows, and would create significant operational and compliance issues.
- C. Incorrect.
Incorrect. Data masking is useful for lower environments like development, testing, and training because it obscures sensitive values while preserving format realism. However, fully masking production data so the original PAN is never retained would prevent legitimate payment processing and authorized mappings back to the original account data. The requirement specifically states that the payment processor must map values back to the original PAN.
- D. Incorrect.
Incorrect. One-way hashing is designed to be irreversible. That makes it useful for password verification in many cases, but not for payment workflows that require the original value to be recovered or mapped for authorized transactions. The statement that customer service could reverse the hash reflects a common misconception about hashing.