Developers need realistic test data copied from a production cloud database that contains customer PII. The test environment has weaker access controls and monitoring than production. Which approach best fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
If you hand developers the real customer list in a less-secure room, you've just moved the risk next door. Static masking swaps in realistic fake values before the data ever gets there. Dynamic masking is the trap: the real PII still sits underneath in the weaker environment.
Full Explanation
Static data masking transforms a copy of production data, replacing sensitive values with realistic but fictitious substitutes that preserve format and relationships, before the copy is loaded into non-production environments. Developers get data that behaves like production for testing, while the test environment never holds real PII, which matters because that environment has weaker controls. Dynamic data masking alters what users see at query time while the underlying stored data remains real; in a weakly controlled test environment the true PII is still present in storage, backups and logs, and anyone bypassing the masking layer can reach it. Encryption at rest protects media and storage layers, but the application decrypts data transparently for its users, so developers would still see real PII. Read-only access prevents modification but not disclosure; viewing the PII is exactly the exposure to avoid. Exam caveat: dynamic masking is appropriate in production where real data must remain but some users should see only partial values, such as the last four digits. Operational check: confirm the masking job runs inside the production boundary and that no unmasked copy is staged in the test environment.