An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy
Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without
real data they cannot perform functionality tests and search for specific data. Which of the following should a
security professional implement to best satisfy both the CPO's and the development team's requirements?


A. Data purge
B. Data encryption
C. Data masking
D. Data tokenization