SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Copy the production database unchanged and limit access to the QA team.

  Why it's wrong here

  Limiting access helps, but the test environment would still contain unnecessary real customer data. That increases privacy risk and could expose sensitive information outside production controls. A safer process is to reduce or replace the sensitive data before it reaches the test system.

• ✓

  Mask, tokenize, or replace sensitive fields with approved test data before moving it.

  Why this is correct

  Masking or tokenizing sensitive fields is the best practice because it preserves the data structure needed for testing while reducing privacy risk. The test environment should not contain raw customer information unless there is a strong approved need. Using approved test data limits exposure if the environment is compromised or shared more broadly than intended.

• ✗

  Compress the database export to reduce storage and transfer time.

  Why it's wrong here

  Compression can make the file smaller, but it does nothing to protect sensitive content. The same real customer data would still be present in the test copy. This option improves logistics, not privacy, and does not address the actual security concern in the scenario.

• ✗

  Encrypt the database backup and give developers the decryption key.

  Why it's wrong here

  Encryption is useful for protecting data at rest, but handing developers the decryption key means the sensitive data is still available to anyone with access. The issue is whether production data should be copied in raw form at all. Masking or tokenization is a better privacy control before the copy occurs.