Masking is used when there is no business requirement to view the entire PAN. Which statement is true?

Masking is used when there is no business requirement to view the entire PAN. Which statement is true?

• A. It is prohibited by PCI DSS
• B. It describes the masking purpose when displayed or printed
• C. It replaces all PAN with asterisks in the database
• D. It encrypts PAN in memory only

Answer: (B)

Masking focuses on protecting PAN data at the point of display or print. When there’s no business need to show the full PAN, you present only the minimum necessary portion (often showing just the last four digits) and obscure the rest. This aligns with PCI DSS guidance to limit exposure by displaying masked PAN rather than the full number. The statement that best captures this is that masking describes its purpose when the PAN is displayed or printed. It emphasizes that masking is a display-control intended to reduce visibility of the full PAN in everyday operations. Masking is not a database operation that rewrites stored PAN values with asterisks; the protected presentation is about what users or systems see, not about permanently altering storage. Encryption and other protections handle data at rest or in memory, but masking itself is specifically about display.

Masking focuses on protecting PAN data at the point of display or print. When there’s no business need to show the full PAN, you present only the minimum necessary portion (often showing just the last four digits) and obscure the rest. This aligns with PCI DSS guidance to limit exposure by displaying masked PAN rather than the full number.

The statement that best captures this is that masking describes its purpose when the PAN is displayed or printed. It emphasizes that masking is a display-control intended to reduce visibility of the full PAN in everyday operations.

Masking is not a database operation that rewrites stored PAN values with asterisks; the protected presentation is about what users or systems see, not about permanently altering storage. Encryption and other protections handle data at rest or in memory, but masking itself is specifically about display.