CIPT practice question 2 of 30

There are two groups of users. In a company, where one group Is allowed to see credit card numbers, while the other group Is not. Both are accessing the data through the same application. The most effective and efficient way to achieve this would be?

Answer options

A: Have two copies of the data, one copy where the credit card numbers are obfuscated, while the other copy has them in the clear. Serve up from the appropriate copy depending on the user accessing it.

B: Have the data encrypted at rest, and selectively decrypt It for the users who have the rights to see it.

C: Obfuscate the credit card numbers whenever a user who does not have the right to see them accesses the data. Correct answer

D: Drop credit card numbers altogether whenever a user who does not have the right to see them accesses the data.

Correct Answer:

C. Obfuscate the credit card numbers whenever a user who does not have the right to see them accesses the data.

Explanation

Dynamic data masking/obfuscation applies a transformation only at display time, letting one dataset serve all users while revealing full numbers solely to authorised roles—minimising copies and administrative overhead.

Why Incorrect

A. Maintaining duplicate datasets increases storage, synchronisation complexity and risk.
B. Encryption at rest protects storage, not fine-grained display; masking is still needed.
D. Dropping (“deleting”) data on each unauthorised request destroys integrity and violates retention requirements.

References

1. NIST SP 800-122 “Guide to Protecting the Confidentiality of PII,” §4.2.3 Data Masking (June 2010).

2. ISO/IEC 20889:2018 “Privacy enhancing data de-identification technologies,” §7.2 (role-based masking).

3. IAPP CIPT Textbook, Ch. 6, pp. 124-126 (dynamic masking for role separation).

Keep practicing

Take the free CIPT practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test