hardMultiple ChoiceObjective-mapped
CCSP Practice Question: Uses cloud databases and needs to protect…
An organization uses cloud databases and needs to protect sensitive fields such as credit card numbers. They want to preserve the ability to perform exact match searches and joins on these fields. Which data protection technique best meets these requirements?
⚠ Common exam trap
ISC2 often tests the distinction between tokenization and deterministic encryption, where candidates mistakenly choose deterministic encryption because it also supports exact match searches, but they overlook that tokenization provides stronger security by removing the mathematical link between the token and the original data, making it resistant to key compromise and frequency analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tokenization with a secure token vault
Tokenization with a secure token vault is correct because it replaces sensitive data (e.g., credit card numbers) with unique, randomly generated tokens that have no mathematical relationship to the original values. The token vault stores the mapping, allowing exact match searches and joins on the tokens while keeping the original data secure, as the tokens are consistent for the same input value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tokenization with a secure token vault
Why this is correct
Tokens can be designed to preserve format and allow exact match joins.
- ✗
Format-preserving encryption (FPE)
Why it's wrong here
FPE is encryption, not tokenization, and may not suit all search needs.
- ✗
Dynamic data masking
Why it's wrong here
Masking does not preserve underlying data for joins.
- ✗
Deterministic encryption
Why it's wrong here
Allows exact matches but encryption is reversible, increasing risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.