SY0-701 Security Architecture Practice Question
Exhibit
Data export sample: CustomerName, CardNumber, OrderTotal, Region A. Lee, 4532 1100 8822 7744, 158.22, West B. Patel, 6011 9009 1044 2219, 41.88, East C. Jones, 6011 9010 3321 1197, 92.10, South Business requirement: - Analytics team needs repeated values for reporting and joins - Full card numbers must not appear in reports or test data
Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?
⚠ Common exam trap
CompTIA often tests the misconception that encryption is always the best data protection control, but the trap here is that encryption still exposes the data to anyone with the key, whereas tokenization removes the sensitive data from the working environment entirely, making it the correct choice for analytics without exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tokenize the card numbers and keep the token mapping in a secured vault.
Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt the entire analytics database and give the team the decryption key.
Why it's wrong here
Encryption at rest with a shared decryption key fails to prevent exposure because analysts must decrypt the data to create reports, so the full card numbers appear in query results, logs, and output files. Granting the team the decryption key gives them the same access as the production application, with no field-level, row-level, or purpose-based access controls. Tokenization avoids this by replacing PANs with non-sensitive tokens that still support joins and aggregation, while the real numbers remain locked in the vault.
- ✓
Tokenize the card numbers and keep the token mapping in a secured vault.
Why this is correct
Tokenization replaces sensitive card numbers with non-sensitive substitutes that can still support joins and repeated reporting without revealing the original values. Keeping the mapping in a secured vault protects the real numbers while allowing the analytics team to work with consistent placeholders. This fits the business need much better than simple encryption or masking alone.
- ✗
Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.
Why it's wrong here
SHA-256 is a one-way cryptographic hash, so it is mathematically impossible to reverse a digest back to the original card number, regardless of the team's intent to 'reverse later.' Credit card numbers have a structured BIN, a check digit, and predictable entropy, making unsalted SHA-256 digests vulnerable to brute-force and rainbow table attacks that can re-identify cardholders. Even with a salt, hashed values lose the format-preserving, lookup-friendly properties needed for reporting, and they do not provide any mechanism for an authorized user to retrieve the PAN for legitimate business purposes.
- ✗
Delete all but the last four digits from the production database immediately.
Why it's wrong here
Deleting all but the last four digits in the production database is a destructive, irreversible act that can break chargeback reconciliation, refund processing, subscription updates, and transaction lookup workflows that rely on the full card number. Unlike tokenization, which preserves a reversible mapping, truncation discards the original data entirely, forcing an emergency restore from backup whenever the PAN is later needed for audits or customer disputes. Additionally, the remaining four digits are not sufficiently unique for reliable joins and can still be combined with other transaction attributes to statistically re-identify cardholders, worsening the data quality while failing to deliver a compliant analytics solution.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.
hard- ✓ A.Tokenize primary account numbers before they reach analytics, reporting, or test systems.
- B.Store backups on the same production storage array to simplify restore operations.
- ✓ C.Encrypt backup sets with keys managed outside the backup repository itself.
- D.Use simple masking only in spreadsheets while leaving the source database unchanged.
- ✓ E.Keep one immutable or air-gapped backup copy to resist ransomware and theft.
Why A: Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.