Exam CISA topic 1 question 760 discussion

Data encryption protects data by making it unreadable without a decryption key, but in development or test environments, developers would need access to those keys to work with the data, which defeats the purpose of protecting PII. In contrast, data masking replaces sensitive values with realistic but fictitious data that can't be reversed, making it a safer and more appropriate choice for non-production environments.

A is the correct answer

A. Data encryption is a strong method for protecting sensitive information, including PII, by converting it into a coded format that can only be accessed by those with the decryption key. However, in development and test environments, encryption might not be the most practical solution because developers often need to work with data in a readable format to test and debug effectively. Data masking (Option A) is generally preferred in these scenarios because it allows developers to work with data that looks and behaves like real data without exposing the actual sensitive information. This approach balances the need for data protection with the practical requirements of development and testing.

Answer is A

Data Encryption involves transforming sensitive data (like PII) into an unreadable format using cryptographic algorithms. Access to the original data is only possible with a decryption key, ensuring that even if the data is intercepted or accessed improperly, it remains protected.

It is C. Data tokenization: Data tokenization involves replacing sensitive data with a token or placeholder value while storing the original data securely elsewhere. This allows developers to work with realistic data without exposing the actual sensitive information. Tokenization maintains data integrity and security while allowing authorized users to use the data in development and test environments. It's a widely adopted method for protecting sensitive information while preserving usability.