An application must confirm that the answer a user types to a security question matches the answer given at enrollment, but the database must never hold the original answers in a form that anyone could recover. Which method should the developers use?
Select an answer to reveal the explanation.
Short Explanation
You don't need to know the answer to check it; you just need to know the new one produces the same fingerprint. That's hashing, and a salt keeps attackers from using precomputed tables. Encryption's the trap here, because anything you can decrypt, an attacker with the key can decrypt too.
Full Explanation
Hashing is a one-way function: the same input always produces the same digest, but the digest cannot be turned back into the input. Storing a salted hash of each enrolled answer lets the application hash the answer typed at verification with the same salt and compare the two digests, proving a match without ever keeping the original. The unique salt per record defeats precomputed lookup tables and prevents identical answers from producing identical stored values. Symmetric encryption is reversible by design, so anyone who obtains the key, including an insider or an attacker who compromises the application server, can recover every answer, violating the requirement. Data loss prevention filtering inspects content to stop it from leaving approved channels; it does not transform what is stored, so the plaintext answers would still sit in the database. Masking that keeps the first and last characters both leaks part of each answer and discards the information needed to verify a full match, so it fails in two directions at once. Exam caveat: hashing is the right primitive for verification of secrets, while encryption is chosen when the original value must later be read. Operational check: inspect the stored column to confirm it contains salted digests rather than readable text, and test that a correct answer validates while a near miss fails.