ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Tokenization replaces each piece of sensitive data with a non-sensitive surrogate or "token" that has no exploitable meaning or value. The actual primary account numbers (PANs) are kept in a separate, highly protected token vault and are retrieved only when absolutely necessary. Format-preserving encryption still stores the cipher text alongside regular data, leaving the encrypted PAN in scope for PCI DSS. One-way hashing with a salt is irreversible, making it unsuitable when the original PAN must sometimes be recovered for settlement or refunds. Data masking simply redacts or obscures part of the value for display or storage but usually leaves the underlying PAN-or portions of it-in the same database, so it does not remove the record from PCI DSS scope.