In MDC3, data obfuscation is used for what purpose, and in which environments is it typically applied?

• A. Data obfuscation is about encrypting data at rest only in production.
• B. Data obfuscation masks or redacts sensitive data in non-production environments to reduce risk.
• C. Data obfuscation means deleting data before testing.
• D. Data obfuscation adds extra fields to data in production.

Answer: (B)

Data obfuscation is used to mask or redact sensitive information so you can use realistic data for development and testing without exposing actual secrets. It’s typically applied in non-production environments—development, testing, and staging—to reduce the risk of sensitive data leakage during the software cycle. The idea is to preserve data structure and realism while de-identifying or replacing sensitive fields. Encryption at rest in production, deleting data before testing, or adding fields in production aren’t examples of obfuscation and don’t serve the same risk-reduction or testing realism goals.