Exam CIPT topic 1 question 158 discussion

B. Have the data encrypted at rest, and selectively decrypt it for the users who have the rights to see it is also a valid and secure approach. In fact, it is a highly effective method for controlling access to sensitive data, such as credit card numbers, based on user permissions. This approach ensures that the data remains encrypted and protected while at rest and only gets decrypted when accessed by authorized users.

The most effective and efficient way to achieve this would be C. Obfuscate the credit card numbers whenever a user who does not have the right to see them accesses the data. This approach ensures that all users are accessing the same single source of data, which is important for maintaining data consistency and integrity. It also avoids the need to manage multiple copies of the data (as in option A) or to manage encryption keys (as in option B). When a user who does not have the right to see the credit card numbers accesses the data, the system can dynamically obfuscate the credit card numbers. This means replacing the numbers with symbols or other characters, making the actual numbers unreadable. Option D, dropping credit card numbers altogether for certain users, could potentially disrupt business operations if those users need to access other parts of the data record that are linked to the credit card numbers.