Examkin

Question

Difficulty: MediumData Governance, Classification, and Privacy Controls

A global financial technology enterprise is updating its analytics warehouse architecture. To comply with privacy regulations while supporting data analysis, the database team replaces primary customer identifiers with cryptographic tokens. The original identifiers and corresponding tokens are stored in a separate, highly secured lookup table, allowing authorized compliance officers to re-identify records during formal legal investigations. Which of the following privacy-enhancing controls has the enterprise implemented?

  1. PseudonymizationAnswer
  2. B
    Anonymization
  3. C
    Static Data Masking
  4. D
    Role-Based Access Control

Answer

Pseudonymization is the correct privacy control because it replaces identifying fields with artificial identifiers (tokens) while preserving the ability to re-identify data subjects using a securely segregated key.
Pseudonymization is a privacy enhancement technique that replaces data subject identifiers with pseudonyms or surrogate keys. Because the mapping key is stored separately and securely, the dataset remains de-identified during routine analytics while allowing authorized personnel to restore identity when required.

Step-by-Step Solution

1
Analyze the privacy requirement in the scenario.
The requirement mandates substituting direct identifiers with cryptographic tokens while retaining a separate lookup key for reversible re-identification under authorized conditions.
Differentiating between reversible and irreversible privacy-enhancing technologies is essential for correct control selection.
2
Evaluate data protection technologies against reversible requirements.
Pseudonymization explicitly decouples identities using tokens and maintains a separate key for re-identification, whereas anonymization is strictly irreversible.
CompTIA Security+ privacy standards define pseudonymization as de-identification with reversible key management.

Key Concept

Pseudonymization versus Anonymization in Privacy Controls
Estimated Time:1m 30s
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic