The best answer is B. It replaces the original data with reference values that do not hold exploitable meaning .
Tokenization protects sensitive data by substituting the original value with a token , which is a non-sensitive reference value. The token has no meaningful value to an attacker if it is intercepted or exposed. The real sensitive data is stored separately in a protected system, often called a token vault.
This is commonly used for:
* payment card data
* personally identifiable information
* sensitive customer records
Why the other options are incorrect:
* A. It permanently deletes sensitive information from production systems. Tokenization does not necessarily delete the original data permanently. It replaces exposed operational use with tokens while the real data is retained securely elsewhere.
* C. It stores sensitive data across multiple cloud environments to prevent data loss. This is unrelated to tokenization.
* D. It conceals data by converting it into unreadable ciphertext using symmetric encryption. This describes encryption , not tokenization.
From a SY0-701 perspective, tokenization reduces exposure by replacing real sensitive values with non- exploitable substitutes , so B is correct.

RBAC stands for Role-Based Access Control, which is a method of restricting access to data and resources based on the roles or responsibilities of users. RBAC simplifies the management of permissions by assigning roles to users and granting access rights to roles, rather than to individual users. RBAC can help enforce the principle of least privilege and reduce the risk of unauthorized access or data leakage. The other options are not as suitable for the scenario as RBAC, as they either do not prevent access based on responsibilities, or do not apply a simplified format. Reference: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 133 1

Firmware is a type of software that is embedded in hardware devices, such as BIOS, routers, printers, or cameras. Firmware controls the basic functions and operations of the device, and can be updated or patched to fix bugs, improve performance, or enhance security. Firmware vulnerabilities are flaws or weaknesses in the firmware code that can be exploited by attackers to gain unauthorized access, modify settings, or cause damage to the device or the network. A BIOS update is a patch that addresses a firmware vulnerability in the basic input/output system of a computer, which is responsible for booting the operating system and managing the communication between the hardware and the software. The other options are not types of vulnerabilities, but rather categories of software or technology.

Access control lists (ACLs) are rules that specify which users or groups can access which resources on a file server. They can help restrict access to confidential data by granting or denying permissions based on the identity or role of the user. In this case, the administrator can use ACLs to quickly modify the access rights of the users and prevent them from accessing the data they are not authorized to see. Reference: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 308 1

Hashing produces a fixed-length fingerprint of the script's contents. By comparing the current hash with a known good hash, the engineer can verify if the script has been altered. Hashing is a one-way function used to validate integrity.
Masking (A) hides data, obfuscation (B) hides code logic, and encryption (D) protects confidentiality but does not verify integrity as simply.
Integrity checking through hashing is fundamental in General Security Concepts#6:Chapter 7 CompTIA Security+ Study Guide#.