ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Tokenization replaces the sensitive value with a surrogate (token) and stores the original value in a separate, secure token vault that the cloud provider cannot access. Because the same input will always return the same token (deterministic tokenization), the SaaS application can perform equality searches on the tokenized SSN while the real SSN remains hidden. When necessary, the organization can reverse the process by querying the vault to retrieve the original value.

Hashing with a salt is intentionally one-way, so the original SSN cannot be recovered, violating the legal discovery requirement. Static data masking permanently alters or removes sensitive characters, likewise preventing restoration. Format-preserving encryption is reversible, but without giving the provider access to the encryption key the application could not perform direct equality searches on ciphertext, and exposing the key to the SaaS operator would violate the requirement that the provider never see the real data. Therefore, tokenization with an on-premises mapping vault is the most appropriate choice.