SY0-701 · Objective 3.3 · Security Architecture
3.3 Protecting data explained
The official objective: “Compare and contrast concepts and strategies to protect data.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 3.3 covers
Objective 3.3 is about data itself: what kind it is, how sensitive it is, where it sits and which protection method fits.
Data types include regulated data (covered by law, such as health or payment data), trade secrets, intellectual property, legal information, financial information, and human-readable versus non-human-readable data. Data classifications label sensitivity. The exam uses terms such as sensitive, confidential, public, restricted, private and critical. Classification exists so that the right handling rules, encryption and access controls are applied consistently, without debating every file.
Data exists in three states. Data at rest is stored on disk or in a database. Data in transit moves across a network. Data in use is being processed in memory. Each state needs its own protection: disk or database encryption at rest, TLS or IPsec in transit, and techniques such as secure enclaves for data in use.
Data sovereignty means data is subject to the laws of the country where it is stored. Geolocation matters because of that. If a law says citizens' records must stay in-country, the protection method is a geographic restriction on where the data may be stored and processed.
The protection methods are the heart of the objective. Geographic restrictions control location. Encryption makes data unreadable without the key and is reversible. Hashing produces a fixed digest and is not reversible, so it suits integrity checks and passwords. Masking hides part or all of a value, for example showing only the last four digits, or replacing real values with realistic fake ones for testing. Tokenization swaps a sensitive value for a random token and keeps the real value in a separate secure vault; the token has no mathematical link to the original, so stealing the database of tokens gives an attacker nothing useful. Obfuscation makes data or code hard to understand. Segmentation keeps sensitive data in its own protected zone. Permission restrictions limit who can read or change it.
Questions typically give a requirement and ask for the method. Must the value be recoverable? Encryption or tokenization, not hashing. Must testers see realistic but fake values? Masking. Must the stored value be useless if stolen and also not mathematically reversible? Tokenization. Must data never leave a country? Geographic restriction.
What candidates mix up
- Tokenization versus encryption: encrypted data can be decrypted with the key; a token can only be swapped back through the vault.
- Masking versus tokenization: masking hides or fakes the value for display or testing; tokenization replaces it for storage and processing.
- Data sovereignty versus geolocation: sovereignty is the legal principle; geolocation is where the data physically is.
Practice questions for 3.3
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A development team needs a copy of the customer database for testing. The SSN column must keep its nine-digit format so validation logic still works. Testers will never need the real numbers, and the security team wants the test copy to offer no way to recover them. Which technique best meets these requirements?
- AStatic data masking that replaces SSN digits with realistic substitute values
- BTokenization that swaps each SSN for a token stored in a secure vault
- CAES-256 encryption of the SSN column with keys held in a key manager
- DMoving real SSNs into a separate table with restricted read permissions
Show answer and explanation
Answer: A) Static data masking that replaces SSN digits with realistic substitute values
Masking is the right choice when the original values are never needed: it keeps the format and is meant to be irreversible. Tokenization and encryption are chosen when the real values must be recoverable.
- AStatic masking makes a sanitized copy for non-production use. It swaps in realistic, correctly formatted values and is meant to be irreversible, so the test copy can't be traced back to the real SSNs.
- BTokenization keeps a mapping that lets authorized systems swap tokens back for the original values. That recovery path is exactly what the security team wants to avoid, and it isn't needed because testers never need the real numbers.
- CEncryption can be reversed by anyone holding the key, so the real SSNs stay recoverable. Ciphertext also doesn't keep the nine-digit format that the validation logic needs.
- DThe real SSNs would still sit in plaintext in the test environment. Access restrictions limit who can read them but don't de-identify the data.
Question 2
A national data sovereignty law requires that personal records of a country's residents be stored and processed only on infrastructure located within that country. A company is moving these records to a public cloud provider. Which design decision best satisfies the requirement?
- AHost the workloads in a cloud region located in that country and limit replicas and backups to that region
- BEncrypt the records with customer-managed keys and replicate them to the provider's global regions
- CTokenize the personal identifiers and store nightly backups in the provider's lowest-cost region
- DPlace a global content delivery network in front of the application to cache responses at edge locations
Show answer and explanation
Answer: A) Host the workloads in a cloud region located in that country and limit replicas and backups to that region
Data sovereignty means data is subject to the laws of the country where it resides. Meeting a residency requirement means choosing in-country hosting regions and keeping replicas and backups there too. Encryption or tokenization alone does not change where data lives.
- ASovereignty and residency requirements constrain where data is physically stored and processed. Choosing a region inside the country and keeping replication and backups there ensures no copy leaves the jurisdiction.
- BEncryption protects confidentiality but does not change where the data physically resides. Replicating it to foreign regions would break the residency requirement.
- CTokenization reduces exposure of identifiers, but choosing a backup region by cost could place copies of the records outside the country.
- DA global CDN caches content at edge locations in many countries. It works against keeping data inside national borders and does nothing to enforce residency.
Question 3
A payment application must store customer card numbers so that a database compromise yields no usable card data, yet the last four digits must still display on receipts and the value must work as a lookup key. Which technique best fits?
- ATokenization — replace the card number with a non-sensitive token, keeping the real value in a separate hardened vault
- BBase64-encode the card numbers
- CStore them in plaintext but restrict the table with permissions
- DHash the card numbers with an unsalted fast hash
Show answer and explanation
Answer: A) Tokenization — replace the card number with a non-sensitive token, keeping the real value in a separate hardened vault
- ATokens have no mathematical relationship to the original data and are useless if stolen, while remaining a stable key; the vault holding the real PAN is isolated and tightly controlled.
- BEncoding is trivially reversible and provides no protection.
- CPermissions alone fail the moment the database is compromised, which is the stated threat.
- DThe small keyspace of card numbers makes an unsalted hash reversible by brute force, and a hash can't be reversed for legitimate processing needs anyway.
Other Security Architecture objectives
Also: the Security Architecture domain page (18% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.