CompTIA Data+ DA0-002 (V2) Practice Question

The correct answer is to render the PAN unreadable using an approved method like truncation, tokenization, or encryption. PCI DSS Requirement 3 specifically mandates that stored Primary Account Numbers (PAN) must be protected. Requirement 3.4 states that the PAN must be rendered unreadable wherever it is stored. Acceptable methods include one-way hashing, truncation (storing only a segment of the PAN, such as the first six and last four digits), tokenization (replacing the PAN with a non-sensitive value), and strong encryption.

• Implementing role-based access control is a necessary part of PCI DSS (Requirement 7), but it is not sufficient on its own. If the data itself is stored unencrypted, a breach of an authorized user's credentials would still expose the plaintext PANs.
• Encrypting data in transit (Requirement 4) is also a key part of PCI DSS, but it does not address the risk of the data being stored insecurely at rest in the database.
• Anonymizing other personally identifiable information like the name and address is a good general data privacy practice but does not address the specific and primary PCI DSS requirement to protect the PAN itself.