A data steward needs to automate data masking for a test environment cloned from production.Which approach best balances realism and privacy?