SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Tokenize primary account numbers before they reach analytics, reporting, or test systems.

  Why this is correct

  Tokenization replaces sensitive values with nonusable substitutes while preserving business usefulness for many workflows. Analysts can still correlate records, but exposed reports and test data no longer reveal the true card number. This is especially valuable for payment data because it reduces the number of environments that ever handle the actual secret value.

• ✗

  Store backups on the same production storage array to simplify restore operations.

  Why it's wrong here

  Storing backups on the same production storage array collapses the separation between live data and recovery copies. A single hardware fault, corruption event, or ransomware attack that encrypts the array will likely destroy both source and backup, making recovery impossible. Additionally, administrative credentials for the array grant access to both, so an attacker who compromises the storage layer can disable or delete backups before deployment. Effective backup resilience requires physically or logically separate storage with independent access controls, ideally immutable or air-gapped copies.

• ✓

  Encrypt backup sets with keys managed outside the backup repository itself.

  Why this is correct

  If backup media is stolen, strong encryption prevents the attacker from reading the contents. Separating key management from the repository reduces the chance that access to the backup system automatically exposes the encryption keys. This is a standard safeguard for backups that may be transported, replicated, or otherwise removed from the primary data center.

• ✗

  Use simple masking only in spreadsheets while leaving the source database unchanged.

  Why it's wrong here

  Simply redacting PANs in spreadsheets leaves every other copy of the full card number untouched, including the production database, transaction logs, and downstream data warehouses. Analysts can bypass the masked spreadsheet entirely by querying the source system directly, and any developer or tester with database access still sees real cardholder data. Masking must be applied consistently at the data layer through dynamic data masking or tokenization, not as a disconnected export step. This approach also creates a false sense of compliance while failing to reduce PCI DSS scope.

• ✓

  Keep one immutable or air-gapped backup copy to resist ransomware and theft.

  Why this is correct

  An immutable or air-gapped backup copy protects recovery data from tampering, deletion, and encryption by ransomware. It also limits the impact of a stolen online backup system because the recovery copy is separated from active write access. This is a core resilience control when backup compromise is part of the threat model.