Exam CISA topic 1 question 760 discussion

A. Data encryption is a strong method for protecting sensitive information, including PII, by converting it into a coded format that can only be accessed by those with the decryption key. However, in development and test environments, encryption might not be the most practical solution because developers often need to work with data in a readable format to test and debug effectively. Data masking (Option A) is generally preferred in these scenarios because it allows developers to work with data that looks and behaves like real data without exposing the actual sensitive information. This approach balances the need for data protection with the practical requirements of development and testing.

Answer is A

Data Encryption involves transforming sensitive data (like PII) into an unreadable format using cryptographic algorithms. Access to the original data is only possible with a decryption key, ensuring that even if the data is intercepted or accessed improperly, it remains protected.

It is C. Data tokenization: Data tokenization involves replacing sensitive data with a token or placeholder value while storing the original data securely elsewhere. This allows developers to work with realistic data without exposing the actual sensitive information. Tokenization maintains data integrity and security while allowing authorized users to use the data in development and test environments. It's a widely adopted method for protecting sensitive information while preserving usability.