In a masking policy, which value can be returned for unauthorized users in the else clause?

• A. The original value
• B. The masked value
• C. Null
• D. A hash of the value

Answer: (D)

Masking policies control exactly what different users can see, and the else clause defines what unauthorized users will receive. Using a hash of the original value in that else clause is a smart choice because it preserves utility without exposing the actual data. A hash is deterministic—the same input always yields the same hash—so you can still perform comparisons or aggregations on masked data, while the original value cannot be easily reconstructed. This balances privacy with analytic usefulness better than returning the actual value (which would leak data) or a plain null or generic mask (which loses more information).