Protecting Data

Question 1 of 6

A web application stores user passwords in a database. A security engineer wants to ensure that even if the database is stolen, the attacker cannot recover the original passwords. Which technique should be used to store passwords?

A. Encrypt each password with AES-256 so that authorized administrators can decrypt it if needed B. Hash each password using SHA-256 and store only the hash — compare hashes at login C. Mask each password by replacing characters with asterisks so stored passwords cannot be read directly D. Tokenize each password by replacing it with a random token that maps back to the original via a lookup table

Question 2 of 6

A call center application displays customer credit card information to agents. To reduce exposure, the application shows only the last four digits: **** **** **** 4532. The full card number is still stored in the database and retrieved by the payment processing subsystem when needed. Which data protection technique is being used?

A. Tokenization — the card number has been replaced with a substitute value with no mathematical relationship to the original B. Encryption — the card number is encrypted and only partially decrypted for display C. Data masking — a portion of the sensitive value is hidden for display purposes while the full value remains intact in storage D. Obfuscation — the card number has been transformed to make it difficult to understand while preserving functionality

Question 3 of 6

A mobile payment system replaces actual credit card numbers with substitute values throughout all merchant systems. The substitutes have no mathematical relationship to the original card numbers. The original values are stored only in a secure, separate server used to authorize transactions. Which technique is this?

A. Tokenization — sensitive values replaced with non-sensitive tokens; original in secure token service only B. Encryption — card numbers encrypted with AES-256; token service holds the decryption key C. Data masking — card numbers displayed with middle digits hidden; last four digits visible for identification D. Hashing — card numbers processed through SHA-256 to produce a fixed-length substitute value

Question 4 of 6

A retail company stores all customer data — names, addresses, Social Security numbers, payment card tokens, and order history — in a single database. A security architect recommends distributing this data across multiple separate databases, with the most sensitive data receiving the highest-level security controls. What is the primary security benefit of this approach?

A. It eliminates the need for encryption because data is spread across multiple systems B. It ensures regulatory compliance automatically because each database is smaller than the maximum allowed size C. It reduces the number of databases the company needs to maintain, simplifying the architecture D. It limits the blast radius of any single breach — a compromise of one database exposes only that segment's data, not everything

Question 5 of 6

A security analyst receives two files and their SHA-256 hashes from a vendor. The analyst downloads the first file and computes its hash: it matches exactly. Then the analyst downloads the second file — the hash does not match the vendor's published value. What does this mismatch indicate?

A. The second file was encrypted during download and must be decrypted before the hash will match B. The second file has been modified — at least one byte differs from the file the vendor hashed, indicating possible tampering or corruption C. The hash algorithm is too sensitive — minor formatting differences in the file cause the hash to change, even if the content is correct D. The vendor's published hash is outdated — SHA-256 hashes expire after a fixed period and must be recomputed

Question 6 of 6

A cryptographic property describes that a good encryption algorithm produces ciphertext that is dramatically different from the plaintext — changing one character of input produces a completely unrecognizable output with no visible relationship to the original. What property of encryption does this describe?

A. Avalanche effect — the property that small input changes produce large output changes B. Diffusion — spreading the influence of plaintext characters across multiple ciphertext positions C. Confusion — making the relationship between ciphertext and key as complex as possible so output bears no visible resemblance to input D. Obfuscation — deliberately altering the data structure to make it difficult to understand

Matching

1. A developer distributes a commercial software library. To prevent competitors from reading the proprietary algorithm, the developer runs the compiled code through a tool that renames variables to meaningless identifiers, flattens control flow, and restructures the code — the resulting file runs identically to the original but is extremely difficult for a human to read and understand

2. An organization converts plaintext data into ciphertext using an AES-256 key; the only way to read the original data is to apply the same key to reverse the transformation — the output bears no resemblance to the input and is completely unreadable without the key

3. A company finds that its single customer database is a constant compliance and security concern — customer PII, payment data, and order history all reside together. The security team splits the data into three separate databases, each on its own server with its own access controls, proportional to the sensitivity of the data it holds

4. A healthcare portal allows nurses to see full patient records, while administrative staff sees the same record but with clinical diagnosis fields replaced by asterisks — the underlying database record is unchanged; only the presentation layer differs based on the authenticated role

1. 2. 3. 4.

A. Obfuscation

B. Encryption

C. Data Segmentation

D. Data Masking

Protecting Data Quiz

Matching