Examkin

Soru

Zorluk: ZorData Governance, Classification, and Privacy Controls

A financial technology enterprise is integrating a third-party analytical platform to evaluate customer payment trends. Legal and privacy compliance requirements state that Primary Account Numbers (PANs) transmitted to the external vendor must be replaced with random surrogate values that maintain no mathematical relationship to the underlying data. Additionally, internal billing microservices must maintain the ability to resolve these surrogate values back to the original PANs using an isolated, highly secure lookup database hosted on-premises. Which of the following privacy-enhancing controls best fulfills these requirements?

  1. Tokenization using a centralized token vaultCevap
  2. B
    Dynamic data masking applied at the database view level
  3. C
    Irreversible data anonymization using one-way cryptographic hashing
  4. D
    Designating the third-party analytics provider as the data owner responsible for privacy enforcement

Cevap

Tokenization using a centralized token vault is the correct privacy-enhancing control.
Tokenization generates random, non-mathematical surrogate characters (tokens) to replace sensitive data like PANs before exporting to third parties. Because the token cannot be derived mathematically from the original value, compromising the external analytics platform does not expose the underlying data. The enterprise retains the mapping in an isolated on-premises token vault, allowing internal microservices to securely re-identify accounts when required.

Adım Adım Çözüm

1
Analyze the technical requirements in the scenario
Identified the need for non-mathematical surrogate values (tokens) and reversible mapping via an isolated lookup database.
The requirement specifies sending non-sensitive placeholder values externally while retaining internal re-identification capability.
2
Evaluate Tokenization against hashing, masking, and anonymization
Tokenization replaces sensitive values with random tokens linked via a secure vault database, matching all requirements.
Unlike encryption or hashing, tokens carry no mathematical link to the payload, minimizing breach exposure on the third-party platform.
3
Differentiate between data governance roles and technical control mechanisms
Confirmed that reassigning ownership roles to third-party vendors is procedurally incorrect and technically ineffective.
The enterprise retains ultimate ownership and accountability for data privacy under governance standards like GDPR/PCI-DSS.

Anahtar Kavram

Tokenization and Data Privacy Enhancing Technologies
Bu soruyu puanla

Konular

Data Governance, Classification, and Privacy Controls

Bu konudan daha fazla soru