Data Masking With Asterisks in a Banking Web Application
A web application for a bank displays the following output when showing details about a customer's bank account: Which of the following techniques is most likely implemented in this web application? - 
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Masking hides part of a live value with placeholder characters so the record still works for the user, while anonymization irreversibly strips identifiers from a dataset so individuals can no longer be linked to it.
The screenshot shows account digits partially replaced with asterisks while the customer is still viewing live account details. That is data masking: part of the original value is hidden in place with substitute characters so the record stays usable while the full number is not disclosed.
Choosing anonymization simply because asterisks hide the value. Anonymization removes or irreversibly alters identifiers so the data can no longer be tied to a person, which would break a customer viewing their own account.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Data masking replaces part of a sensitive value with placeholder characters such as asterisks while leaving the surrounding data intact, which is exactly what the screenshot shows on a bank account number. The customer still recognises the account and can act on it, while anyone reading over their shoulder or capturing the screen cannot recover the full number. Masking is applied at display time and stays reversible for authorised systems that pull the real value from the database.Why the Other Options Are Wrong
Data minimization is a collection principle: it means only gathering the data the business actually needs, and it says nothing about how an already stored value is rendered on screen. Data scrambling reorders or randomises characters into unreadable output, which would leave the account unusable for the customer rather than partially hidden. Anonymization irreversibly removes identifiers so a record can no longer be linked to an individual, a technique for analytics and shared datasets rather than for a customer viewing live account data.Community Comment Notes
The discussion is overwhelmingly on masking, with commenters citing the everyday example of a card or account number shown with only the last four digits. A recurring objection argues for anonymization on the grounds that masking substitutes a different but realistic value; that describes tokenization or synthetic data, not the character substitution shown here. Several also point out that a masked field still has to be protected where it rests, since hiding it on screen is not encryption.Official Reference
Exam Strategy
Separate the four data-handling terms by purpose and reversibility: minimization limits collection, masking hides part of a live value, scrambling and tokenization substitute an unusable value, and anonymization permanently severs the link to the individual.
Frequently Asked Questions
How is data masking different from anonymization on the Security+ exam?
Masking hides part of a value at the presentation layer while the real data still exists behind it, whereas anonymization permanently removes identifiers so no record can be tied to an individual.
Does masking the account number on screen satisfy a requirement to protect stored cardholder data?
No. Display masking only limits what is rendered to the user, so the underlying value still needs encryption at rest, access control, and auditing to meet storage requirements.