Examkin

Question

Difficulty: MediumData Protection and Storage Security Architecture

A enterprise payment processing organization needs to protect sensitive credit card Primary Account Numbers (PAN) stored within a centralized relational database. The security architecture team must ensure that if an unauthorized user or database administrator queries the storage tables, the sensitive numerical data is not exposed. Additionally, downstream analytics applications must be able to process database records without altering the underlying database schema length or data format. Which of the following storage data protection mechanisms best meets these architectural requirements?

  1. Tokenization of sensitive data fieldsAnswer
  2. B
    Asymmetric RSA bulk encryption of database storage volumes
  3. C
    Cryptographic hashing of storage records for non-repudiation
  4. D
    Stateful network firewall filtering between application and storage tiers

Answer

Tokenization of sensitive data fields is the most appropriate control because it substitutes sensitive values with non-sensitive tokens while preserving data format and length for database compatibility.
Tokenization replaces sensitive numbers with non-sensitive surrogate tokens that match the original data type and format. This prevents unauthorized users and database administrators from viewing raw sensitive data while allowing existing application schemas and analytics jobs to function without structural modifications.

Step-by-Step Solution

1
Analyze the operational requirements
The requirements demand protecting sensitive records against internal database query exposure while maintaining length and format compatibility for downstream reporting.
Database schema preservation prevents downstream application failures while securing sensitive fields at rest.
2
Evaluate data protection controls against format-preserving requirements
Tokenization maps sensitive records to format-preserving surrogate values without exposing original data to unauthorized queries.
Tokenization isolates the underlying sensitive data in a token vault while providing safe surrogate values to database consumers.

Key Concept

Data Tokenization and Format-Preserving Protection
Rate this question

Topics

Data Protection and Storage Security Architecture

More questions from this topic