SY0-701 Security Program Management and Oversight Practice Question
A help desk team needs sample customer tickets in a lower environment for testing. The records contain names, phone numbers, and case details. Which approach best reduces privacy risk while still allowing useful testing?
⚠ Common exam trap
It's easy for candidates to choose Option A (exact copy) thinking it is the most efficient for testing, overlooking that privacy risk in a lower environment is a critical security concern that must be mitigated even at the cost of convenience.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mask or tokenize the personal data before loading it into test
Data masking or tokenization replaces sensitive personal information (names, phone numbers) with realistic but fictitious values, preserving the dataset's utility for testing while minimizing exposure of real PII. This approach aligns with privacy best practices and regulatory requirements like GDPR or HIPAA, as the test environment never contains actual customer data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Copy the production database exactly into the test system
Why it's wrong here
Copying the production database verbatim replicates every real customer record into the test environment with no transformation. That violates data minimization and creates unnecessary sensitive-data exposure, because test environments typically have weaker access controls and monitoring than production. Even if the test system is internal, a breach or careless query can leak genuine PII, whereas masking would have made the data non-sensitive.
- ✓
Mask or tokenize the personal data before loading it into test
Why this is correct
Masking or tokenization transforms identifying values—such as names, email addresses, and account numbers—into realistic substitutes while preserving the format and relationships needed for functional testing. Tokenization can be reversible with a secure token vault, while masking is typically irreversible, but both reduce the blast radius if test data is compromised. This approach supports privacy regulations like GDPR and PCI DSS by ensuring real personal data is not used in non-production systems.
- ✗
Email the records to developers so they can import them manually
Why it's wrong here
Emailing records to developers sends sensitive data over a channel not designed for bulk structured data, and it creates additional copies in mail servers, client caches, and backup archives. This bypasses centralized access controls and leaves no reliable audit trail for who accessed or retained the data. Even if TLS is used in transit, the recipients' mailboxes and synced devices are usually unencrypted at rest, making this handling practice unsafe.
- ✗
Store the records in an unencrypted spreadsheet on a shared drive
Why it's wrong here
An unencrypted spreadsheet on a shared drive leaves real personal data at rest with only the folder's coarse-grained permissions, which often allow broad read access. Spreadsheets are also easy to duplicate, rename, or exfiltrate without triggering detection, and they lack field-level protection or logging. This fails confidentiality and data minimization requirements and compounds the risk by combining all data into a single portable file.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
PII
PII stands for Personally Identifiable Information, which is any data that can be used to identify a specific individual.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.