Which technique is used to protect sensitive data in non-production environments?

• A. Tokenization is the same as masking.
• B. Data masking hides sensitive data in non-production environments.
• C. Data replication ensures security.
• D. Full encryption at rest is a masking technique.

Answer: (B)

In non-production environments, the aim is to prevent real sensitive values from being exposed while keeping data usable for testing. Data masking achieves this by replacing sensitive fields with plausible, fake values that maintain the same format and length. This lets developers and testers work with realistic data structures without revealing actual data, helping meet privacy and compliance requirements.

Tokenization is related but not the same; it substitutes data with tokens that require a vault to map back to the original values, which isn’t as straightforward for testing scenarios. Data replication isn’t a security technique—it’s about duplicating data for availability or testing and can introduce risk if not secured. Full encryption at rest protects data on storage, but it doesn’t hide the values once the data is decrypted for application use in non-production environments, and it doesn’t provide the same testing-friendly obfuscation as masking.

So data masking is the best fit to protect sensitive data in non-production environments.