Which of the following strategies most effectively protects sensitive data at rest in a database?

Masking involves altering the data to hide its original content but still allows for some level of usability. While it protects sensitive information from unauthorized access, it can still be reversed if the masking technique is not robust enough. Therefore, it is not as secure as hashing, which provides a one-way transformation.

Tokenization replaces sensitive data with non-sensitive equivalents, called tokens, that can be mapped back to the original data. While this method secures data, it requires a secure mapping system to retrieve the original information, which can be a vulnerability if not managed properly. This makes it less effective than hashing for protecting data at rest.

Obfuscation involves deliberately making data difficult to understand or interpret. However, it does not prevent access to the original data; it merely complicates its readability. As a result, it is a weaker method of data protection compared to hashing, which ensures that the original data cannot be reconstructed.