A bank's QA team needs realistic customer tables for load testing, but production names, account numbers and emails cannot leave the production boundary. Which technique should the data team apply before copying the data?
Show answer and explanation
Answer: B
Tokenization swaps sensitive identifiers for surrogate values that keep the same general format, and masking hides or scrambles the remaining sensitive fields. Applying these transformations before the copy leaves real personal data outside the boundary while the test data still behaves realistically. Logging and network records help with auditing and troubleshooting, and Savings Plans are a billing mechanism. None of those protects data values.
Why the other options are wrong
- A. CloudTrail data events record object-level API calls for auditing. They do not alter the values in the tables, so real customer data would still be copied.
- C. VPC Flow Logs record IP traffic metadata between network interfaces. They say nothing about the content or sensitivity of the data being copied.
- D. Savings Plans reduce compute prices for committed usage. They have no effect on whether sensitive data is exposed in a non-production environment.