mediumMultiple SelectObjective-mapped
CISA Practice Question: Which TWO of the following are key controls for…
Which TWO of the following are key controls for ensuring data privacy during system development?
⚠ Common exam trap
Test-takers frequently confuse 'data masking' with 'anonymization' and overlook its role as a key privacy control, or mistakenly think that using real data in test environments is acceptable if it is 'just for testing,' ignoring regulatory and ethical requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypting stored data
Encrypting stored data (Option B) is a key control for ensuring data privacy because it renders the data unreadable without the correct decryption key, protecting it from unauthorized access even if the storage medium is compromised. This aligns with data-at-rest protection requirements under regulations like GDPR and PCI DSS, and is a fundamental security control during system development to prevent exposure of sensitive information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using real customer data for testing
Why it's wrong here
Using real customer data increases exposure and violates data privacy principles.
- ✓
Encrypting stored data
Why this is correct
Encryption provides a strong control to protect sensitive data at rest.
- ✗
Disabling audit logs during development
Why it's wrong here
Audit logs are essential for detecting and investigating privacy breaches.
- ✗
Allowing developers unlimited access to production data
Why it's wrong here
Unlimited access increases the risk of unauthorized exposure or misuse.
- ✓
Data masking in test environments
Why this is correct
Data masking replaces sensitive data with realistic but fictitious data, reducing privacy risk.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.