hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: An analyst is preparing a report that includes…
An analyst is preparing a report that includes Personally Identifiable Information (PII) from a data breach. The report will be shared with external auditors. Which of the following is the BEST practice for handling PII in the report?
⚠ Common exam trap
CompTIA often tests the misconception that encryption alone is sufficient for data protection in reports, but the trap here is that encryption only secures data in transit or at rest, not after decryption by the recipient, whereas tokenization/pseudonymization provides persistent masking even after the data is accessed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use tokenization or pseudonymization to mask PII while preserving analytical value
Tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include full PII in the report for complete transparency
Why it's wrong here
Including full PII (Personally Identifiable Information) in a report, even for the stated goal of complete transparency, is a severe violation of numerous data privacy regulations such as GDPR, HIPAA, and CCPA. This practice significantly increases the risk of data breaches, identity theft, and misuse, leading to substantial legal penalties, reputational damage, and a profound loss of trust. Compliance frameworks explicitly mandate minimizing PII exposure, not maximizing it, to protect individual privacy.
- ✗
Encrypt the report and send it via email to auditors
Why it's wrong here
While encryption effectively protects the report's confidentiality during transit and at rest, it does not anonymize or mask the PII contained within the document itself once decrypted. Auditors, upon successfully decrypting the report, would still have direct, unmasked access to all sensitive PII, which contradicts the fundamental goal of minimizing exposure and adhering to the principle of least privilege. This approach fails to address the intrinsic risk of PII visibility to authorized recipients.
- ✓
Use tokenization or pseudonymization to mask PII while preserving analytical value
Why this is correct
Tokenization replaces sensitive PII with a non-sensitive, algorithmically generated surrogate value (a token), while pseudonymization replaces direct identifiers with a reversible, artificial identifier. Both methods effectively mask the original PII, significantly reducing the risk of direct exposure and compromise, while still allowing auditors to perform necessary analysis, linkage, and validation using the masked data. This approach maintains data utility and analytical value for auditing purposes without compromising individual privacy or violating compliance mandates.
- ✗
Remove all PII entirely, leaving only anonymized records
Why it's wrong here
Completely removing all PII and leaving only anonymized records, while maximizing privacy, often eliminates the necessary context, granularity, or linkage required for effective auditing and validation processes. Auditors frequently need to verify specific transactions, records, or user activities against original or linked identifiers to ensure accuracy, compliance, and accountability. Irreversible anonymization sacrifices the critical analytical and verification value needed for a thorough and credible audit.
Go deeper
Related to this question
Learn chapter
Memory Forensics and Volatile Data
Key term
Payment Card Industry Data Security Standards
A set of security rules that any company that handles credit card payments must follow to protect cardholder data from theft and fraud.
Key term
Pseudonymization
Pseudonymization is a data processing technique that replaces private identifiers with artificial identifiers, or pseudonyms, to protect personal data while still allowing for analysis and processing.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.