easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Is adopting a cloud-based data warehouse and…
An organization is adopting a cloud-based data warehouse and needs to ensure data masking is applied to personally identifiable information (PII) for analysts who should not see actual values. Which technique is most appropriate?
⚠ Common exam trap
Watch out — candidates often confuse dynamic data masking with encryption or tokenization, assuming that any technique that 'hides' data is equivalent, but CCSP emphasizes that DDM is the only method that applies masking at query time without altering the stored data or requiring a separate mapping system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic data masking in the data warehouse.
Dynamic data masking (DDM) is the correct choice because it applies masking rules at query runtime directly within the data warehouse, allowing analysts to see obfuscated PII without altering the underlying stored data. This meets the requirement for on-the-fly masking for specific users while preserving the original values for authorized roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dynamic data masking in the data warehouse.
Why this is correct
Dynamic masking applies policies at query runtime without altering stored data.
- ✗
Static data masking on the source database.
Why it's wrong here
Static masking creates a copy with masked data, but it is not dynamic for real-time queries.
- ✗
Encrypt the PII columns and restrict the decryption key.
Why it's wrong here
Encryption requires key management and may affect performance; masking is better for read-only access.
- ✗
Tokenization of the PII fields.
Why it's wrong here
Tokenization replaces data with tokens but is not typically used for masking in queries.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.