Which of the following would provide the BEST stress testing environment taking under consideration and avoiding possible data exposure and leaks of sensitive data? 

Answer options:

A. Test environment using test data.
B. Test environment using sanitized live workloads data.
C. Production environment using test data.
D. Production environment using sanitized live workloads data.

B

The best way to properly verify an application or system during a stress test would be to expose it to "live" data that has been sanitized to avoid exposing any sensitive information or Personally Identifiable Data (PII) while in a testing environment.Fabricated test data may not be as varied, complex or computationally demanding as "live" data.A production environment should never be used to test a product, as a production environment is one where the application or system is being put to commercial or operational use.It is a best practice to perform testing in a non-production environment. Stress testing is carried out to ensure a system can cope with production workloads, but as it may be tested to destruction, a test environment should always be used to avoid damaging the production environment.Hence, testing should never take place in a production environment.If only test data is used, there is no certainty that the system was adequately stress tested. Incorrect answers: Test environment using test data. This is incorrect because live data is typically more useful during stress testing Production environment using test data. This is incorrect because the production environment should not be used for testing. Production environment using live workloads. This is incorrect because the production environment should not be used for testing. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 299). And: KRUTZ, Ronald L. & VINES, Russel
D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 251. And: