Data Masking With Asterisks in a Banking Web Application

SY0-601 By islever Editorial Last updated

Short answer

C Data masking hides part of the live account number with asterisks, so the customer still recognises the account while the full value is not disclosed.

Question

A web application for a bank displays the following output when showing details about a customer's bank account: Which of the following techniques is most likely implemented in this web application? - Exhibit: Data Masking With Asterisks in a Banking Web Application
  1. Data minimization
  2. Data scrambling
  3. Data masking Correct Answer
  4. Anonymization

Key Takeaways

Masking hides part of a live value with placeholder characters so the record still works for the user, while anonymization irreversibly strips identifiers from a dataset so individuals can no longer be linked to it.

The screenshot shows account digits partially replaced with asterisks while the customer is still viewing live account details. That is data masking: part of the original value is hidden in place with substitute characters so the record stays usable while the full number is not disclosed.

Common mistake: Choosing anonymization simply because asterisks hide the value. Anonymization removes or irreversibly alters identifiers so the data can no longer be tied to a person, which would break a customer viewing their own account.

Expert Analysis

Why the Answer Is Correct

Data masking replaces part of a sensitive value with placeholder characters such as asterisks while leaving the surrounding data intact, which is exactly what the screenshot shows on a bank account number. The customer still recognises the account and can act on it, while anyone reading over their shoulder or capturing the screen cannot recover the full number. Masking is applied at display time and stays reversible for authorised systems that pull the real value from the database.

Why the Other Options Are Wrong

Data minimization is a collection principle: it means only gathering the data the business actually needs, and it says nothing about how an already stored value is rendered on screen. Data scrambling reorders or randomises characters into unreadable output, which would leave the account unusable for the customer rather than partially hidden. Anonymization irreversibly removes identifiers so a record can no longer be linked to an individual, a technique for analytics and shared datasets rather than for a customer viewing live account data.

Community Comment Notes

The discussion is overwhelmingly on masking, with commenters citing the everyday example of a card or account number shown with only the last four digits. A recurring objection argues for anonymization on the grounds that masking substitutes a different but realistic value; that describes tokenization or synthetic data, not the character substitution shown here. Several also point out that a masked field still has to be protected where it rests, since hiding it on screen is not encryption.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Separate the four data-handling terms by purpose and reversibility: minimization limits collection, masking hides part of a live value, scrambling and tokenization substitute an unusable value, and anonymization permanently severs the link to the individual.

Frequently Asked Questions

How is data masking different from anonymization on the Security+ exam?

Masking hides part of a value at the presentation layer while the real data still exists behind it, whereas anonymization permanently removes identifiers so no record can be tied to an individual.

Does masking the account number on screen satisfy a requirement to protect stored cardholder data?

No. Display masking only limits what is rendered to the user, so the underlying value still needs encryption at rest, access control, and auditing to meet storage requirements.

More SY0-601 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Baba111222 👍 3 Answered D
    It has to be Anonymization, look at the "" ;) Data making would change the whole string to something else, but within the same context like John Doe to Mark Smith, while anonymization replaces value characters with f.ex.: "" og "x", changing John Doe to J or Jxxx xxx.
  2. RedDog2 👍 3 Answered C
    Data masking is a way to create a fake, but a realistic version of your organizational data. The goal is to protect sensitive data, while providing a functional alternative when real data is not needed—for example, in user training, sales demos, or software testing.
  3. tnar140 👍 3 Answered C
    Using asterisks (*) to replace sensitive data, such as personal identification numbers or credit card numbers, is a common masking technique.
  4. klinkklonk 👍 2 Answered C
    DATA MASKING Like when something asks you to verify your car **1234 they mask part of the info.
  5. russian 👍 1 Answered C
    masking is using * to cover up sensitive data
Show 3 more comments
  1. DJ305 👍 10 Answered C
    bro's a millionaire
  2. Hs1208 👍 4 Answered C
    C. Data Masking
  3. Imjusthere00 👍 1 Answered C
    Data Masking

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide