SY0-701 Security Architecture Practice Question
A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?
⚠ Common exam trap
A common mix-up: candidates confuse tokenization with hashing, assuming both are irreversible, but hashing is reversible for small input spaces like credit card numbers and does not provide a controlled surrogate for business correlation without exposing the original data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tokenization, because it replaces the real value with a surrogate token for business use.
Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tokenization, because it replaces the real value with a surrogate token for business use.
Why this is correct
Tokenization replaces the real primary account number (PAN) with a randomly generated surrogate token that retains the same length and format, enabling the payment processor to perform transactions, lookups, and analytics without exposing the original card data. The actual PAN resides in a highly restricted token vault, so even if application databases or reports are compromised, the sensitive value remains secured.
- ✗
Hashing, because the output can always be reversed by the application later.
Why it's wrong here
A cryptographic hash is a deterministic one-way function, meaning the same input always produces the same output, but the original input cannot be recovered from the hash. The claim that the output can be reversed is incorrect; the application cannot reconstruct the card number from the hash, making it unusable for scenarios that require accessing the original PAN, such as issuing refunds or handling chargebacks.
- ✗
Data masking, because it permanently deletes the sensitive record from the database.
Why it's wrong here
Data masking, such as showing only the last four digits, is a presentation-layer technique that alters how data appears to users, but it does not change the actual value persisted in the database. The full card number remains stored in cleartext and can be exposed through direct database access, SQL injection, or misconfigured backups, so it offers no protection for data at rest.
- ✗
Compression, because reducing file size also hides the payment information from users.
Why it's wrong here
Compression encodes data using algorithms like gzip or LZ77 to reduce storage footprint and transmission time, but it provides zero confidentiality because it is fully reversible with the matching decompression routine. Unless encryption is applied separately, any user or attacker with read access to the compressed file can decompress it to retrieve the original card numbers, making it irrelevant to data protection.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.