What is required regarding test data and test accounts before production activation?

• A. Test data should remain in the production environment
• B. Test data and test accounts must be removed before production activation
• C. Test data should be anonymized and retained
• D. Test data should be copied to production for validation

Answer: (B)

Before production activation, remove all test data and test accounts. The production environment should contain only live, authorized data and credentials. Leaving test artifacts or accounts behind creates opportunities for unauthorized access, data exposure, or testing activities leaking into live systems. Clearing these items ensures proper separation between testing and production, reduces risk, and supports compliance with data protection practices.

Keeping test data in production would blur the line between testing and live operations. Copying test data into production for validation reintroduces unnecessary risk to real cardholder information. Anonymizing and retaining test data in production still leaves data within the live environment and can complicate governance and access control. The required practice is to ensure no test data or test accounts remain once going live.