A bank's support agents use a SaaS case-management tool and must see enough of a customer record to help, but must never view full national identity numbers on screen. The stored production values must stay intact for other authorised processes. What is the best control to apply?
- AApply dynamic data masking so the identity number is obfuscated for the support role while the stored value is unchanged. Correct
- BEncrypt the identity-number column at rest so it is unreadable without the decryption key.
- CTokenise the identity number so agents only ever handle a surrogate held in a token vault.
- DStatically anonymise the identity-number field across the production database to break re-identification.
Why A is correct: Dynamic masking rewrites the value at query time based on the requesting role, so support agents see a masked field while the underlying production data remains intact for other authorised processes.
Why B is wrong: At-rest encryption protects stored bytes but authorised application users decrypt to plaintext during normal use, so support agents would still see the full number on screen.
Why C is wrong: Tokenising the stored value would replace it everywhere and require a vault and detokenisation for every legitimate use, which is disproportionate when the need is only to hide the field from one role at display time.
Why D is wrong: Static anonymisation permanently destroys the real values, which conflicts with the requirement to keep the stored production data intact for other authorised processes.