Security Architecture
Targeted SY0-701 practice for this exam objective, with an explanation for every answer option.
- Certification
- SY0-701
- Domain
- Security Architecture
- Questions
- 10
Practice SY0-701 Security Architecture questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
A global DeFi platform processes on-chain transactions and off-chain KYC data in multiple jurisdictions. It must protect sensitive data while retaining utility for non-production testing and aggregate analytics. Select TWO data-protection techniques that best meet these requirements.
- Dynamic Data Masking
- Tokenization
- Format-Preserving Encryption (FPE)
- Anonymization
Dynamic Data Masking — Dynamic Data Masking is ideal for non-production testing environments. It obfuscates sensitive data in real-time when accessed by unauthorized users or non-production applications, displaying realistic but fictitious values. This maintains the data's format and referential integrity, allowing developers and testers to work with data that mimics production data without exposing actual PII, directly addressing the utility for non-production testing.
Tokenization — Tokenization replaces sensitive data with a non-sensitive surrogate (token) while maintaining referential integrity. While excellent for safeguarding PII in production environments and maintaining data utility in transactional systems, it is less directly suited than dynamic data masking for providing realistic-looking but fake data for diverse non-production testing scenarios, or for completely removing PII status for aggregated analytical reporting in the way anonymization does.
Format-Preserving Encryption (FPE) — Format-Preserving Encryption (FPE) encrypts data while retaining its original format, which can be useful for integrating with legacy systems. However, FPE data is still encrypted PII; it does not remove the PII status, nor does it provide realistic fake data for testing or irreversible transformation for analytical reporting. It is primarily a confidentiality control, not a technique to de-identify data for compliance or utility in the specified scenarios.
Anonymization — Anonymization is highly appropriate for aggregated analytical reporting. It involves irreversibly transforming PII so that the data subject cannot be identified directly or indirectly. Once anonymized, data is no longer considered PII under regulations like GDPR and CCPA, significantly reducing compliance burden for analytical purposes while still allowing for valuable insights into trends and patterns without compromising individual privacy.