A vendor demo needs production-like municipal data in a test environment. Which practice appropriately reduces exposure?
Select an answer to reveal the explanation.
Short Explanation
Demos love realistic data, attackers love realistic data too. Scrub or obfuscate the clone so the vendor sees the shape without the real citizen secrets. Handing over live production or domain-admin is the opposite of a demo plan.
Full Explanation
Lower environments and vendor demos need realistic structure without live citizen identifiers. Obfuscating, masking, synthesizing, or otherwise transforming sensitive fields in production clones preserves referential shape for testing while reducing privacy and breach impact if a laptop, cloud bucket, or partner network is compromised.
Cloning production verbatim onto a vendor laptop exports live PII and expands the trust boundary to unmanaged hardware. Emailing full production databases to personal accounts multiplies uncontrolled copies outside municipal custody. Granting the vendor domain-admin on production for convenience replaces a data problem with a privilege problem and endangers the live civic systems.
Exam caveat: obfuscation must be irreversible enough for the threat model—simple encoding is not anonymization. Maintain referential integrity where applications require it, and document which fields were transformed for auditors.
Operational check: use an approved scrubbing pipeline before any non-production refresh, ban production clones on removable vendor media, provide vendors a dedicated demo tenant with synthetic data, and review access tickets so domain-admin was never the “easy” demo path.