The correct answer is Replacing sensitive data elements with a nonmeaningful or randomized token.

Tokenization replaces an original sensitive value with a surrogate value that has no intrinsic meaning. The mapping between the token and the original data is kept in a secure token vault or mapping system and it is required to reverse the token back to the original value. This approach reduces exposure of the sensitive data and limits the systems that need strong protections.

A program of policies and tools that ensures only authorized personnel can view sensitive information is describing access control or data governance and not the specific technique of substituting data values. That answer is therefore incorrect.

Converting input into a fixed length digest using a one way mathematical function describes hashing. Hashing is typically one way and cannot be reversed without brute force or a lookup table, so it differs from tokenization which relies on a reversible mapping under controlled conditions.

A practice for storing and protecting cryptographic keys describes key management and is not tokenization. Tokenization does not primarily refer to key storage and management.

Full AWS Practitioner Certification Question