Question

A retail organization is redesigning its point-of-sale system to reduce the scope of PCI DSS compliance. The security team needs to protect credit card numbers while still allowing the system to reference transactions for returns and customer service inquiries. The solution must ensure that if the database is compromised, actual card numbers cannot be retrieved. Which data protection method best meets these requirements?

Accepted Answer

Tokenization with tokens stored in the transaction database and card data stored in a separate secure vault

Answer

Data masking by displaying only the last four digits of card numbers in all system interfaces

Answer

AES-256 encryption of card numbers with keys stored in a hardware security module

Answer

SHA-256 hashing of card numbers before storing them in the transaction database