3.3 - Data protection: classification, tokenization and masking
Security+ SY0-701 objective 3.3 covers protecting data in its different states and forms. TLS/HTTPS protects data in transit across a network, while encryption at rest protects stored data. Tokenization replaces a sensitive value, like a credit-card number, with a non-sensitive substitute that maps back only in a secure vault, so systems handle tokens instead of real data. Data masking shows only part of a value, such as displaying a card as ****-1234 on a receipt. Data classification sorts information as Public, Internal, Confidential or Restricted so each level gets the right protection. You should also know data states (in use, in transit, at rest), sovereignty, and data loss prevention. Expect scenario questions that describe a data-handling requirement and ask which protection technique - encryption, tokenization, masking or classification - is correct.
Data in transit = TLS/HTTPS. Replace a card number with a mapped substitute = tokenization. Show ****-1234 = data masking. Public/Internal/Confidential/Restricted = data classification.
Practice questions
1. Which protects data IN TRANSIT across a network?
- Full-disk encryption
- TLS/HTTPS (correct answer)
- Shredding paper
- BIOS password
TLS (HTTPS/VPN) encrypts data in transit. Full-disk encryption protects data at rest; both are needed for full coverage.
2. What is the purpose of a Data Loss Prevention (DLP) system?
- Speed up the nightly backups
- Stop sensitive data leaving (correct answer)
- Encrypt the entire system disk
- Store and rotate user passwords
DLP inspects data in email, uploads and endpoints to detect and block exfiltration of sensitive info (PII, cards, IP) per policy.
3. Replacing a credit-card number with a non-sensitive substitute value that maps back in a secure vault is:
- Symmetric encryption
- Tokenization (correct answer)
- Hashing the value
- Steganography
Tokenization swaps sensitive data for a token; the mapping lives in a secure vault. It removes sensitive data from systems (common for PCI DSS card data).
4. Sorting data as Public, Internal, Confidential or Restricted so it gets the right controls is:
- Data tokenization
- Data classification (correct answer)
- Full-disk encryption
- Data replication
Data classification labels information by sensitivity so appropriate handling, access and protection apply. It drives labeling, encryption and retention decisions.
5. Which data state is generally the HARDEST to protect because data must be decrypted to be processed?
- Data at rest
- Data in transit
- Data in use (correct answer)
- Data in backup
Data in use sits decrypted in memory/CPU while processed, so it's hardest to protect. Emerging defenses: secure enclaves and confidential/homomorphic computing.
6. Showing only the last four digits of a card as ****-1234 on a receipt is an example of:
- Full-disk encryption
- Data masking (correct answer)
- Data replication
- Key stretching
Data masking hides part of a value (e.g., ****1234) so it's usable but not fully exposed. Tokenization replaces it entirely; encryption makes it unreadable without a key.