hardMultiple ChoiceObjective-mapped
CISA Practice Question: A company stores sensitive customer data in a…
A company stores sensitive customer data in a database. To comply with privacy regulations, the data must be anonymized for analytics. Which technique provides the strongest anonymization while preserving data utility?
⚠ Common exam trap
Test-takers frequently confuse pseudonymization (e.g., tokenization) with anonymization, or assume that simply removing direct identifiers is sufficient, failing to recognize that re-identification via quasi-identifiers is a well-known attack vector in privacy regulations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Differential privacy with calibrated noise.
Differential privacy with calibrated noise is the strongest anonymization technique because it provides a formal mathematical guarantee that the output of a query does not reveal whether any specific individual's data was included. By adding carefully calibrated noise to query results, it preserves statistical utility for analytics while ensuring that re-identification is provably infeasible, meeting strict privacy regulations like GDPR or CCPA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Differential privacy with calibrated noise.
Why this is correct
Correct. Differential privacy provides mathematical guarantees against re-identification while allowing statistical queries.
- ✗
Tokenization with a reversible mapping.
Why it's wrong here
Reversible tokenization is pseudonymization, not true anonymization, as the mapping can be reversed.
- ✗
Removing direct identifiers like names and SSNs.
Why it's wrong here
Removing direct identifiers alone is insufficient because of linkage attacks using quasi-identifiers.
- ✗
Data masking with static substitution.
Why it's wrong here
Masking may be reversible or insufficient against inference attacks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.