Data masking hides sensitive information by replacing, redacting, or transforming it so the original value is not normally recoverable in routine use. It is commonly used for test, development, analytics, and reporting environments where users need realistic-looking data but should not see actual sensitive values. Tokenization replaces sensitive data with a token that has no exploitable meaning by itself. The original value is stored separately in a secure token vault, allowing authorized systems to reverse the token back to the real value when needed. Encryption is different because it mathematically transforms data using keys. For Security+, the key distinction is reversibility: masking is usually irreversible, while tokenization is reversible through controlled lookup.

Firewall logs are the best source for identifying the attacker's source IP address during port scanning activity at the network edge. A firewall sits at or near the boundary between trusted and untrusted networks and records traffic attempts, including source IP, destination IP, protocol, port, action taken, and timestamps.
Since the scans are occurring on the edge of the corporate network, firewall telemetry is the most relevant data source. Security logs usually refer to operating system authentication or authorization events, not perimeter scan traffic. Application logs record application-level behavior and errors. Endpoint logs are useful for host activity, processes, and local connections, but the question specifically points to edge scanning.
Therefore, firewall logs are the correct operational source.

Using two different cloud solutions to store data is an example of platform diversity, which helps reduce dependency on a single cloud provider and enhances resilience against vendor-specific failures or outages.
Load balancing (A) distributes workloads across resources; parallel processing (B) refers to simultaneous processing of tasks; clustering (D) involves grouping servers to act as a single system.
Platform diversity is a recognized architectural strategy to improve availability and fault tolerance, covered in Security Architecture concepts for SY0-701#6:Chapter 10 CompTIA Security+ Study Guide#

SQL injection is a type of attack that exploits a database misconfiguration or a flaw in the application code that interacts with the database. An attacker can inject malicious SQL statements into the user input fields or the URL parameters that are sent to the database server. These statements can then execute unauthorized commands, such as reading, modifying, deleting, or creating data, or even taking over the database server. SQL injection can compromise the confidentiality, integrity, and availability of the data and the system. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215 1