Professional Cloud Architect

By Google · Question Mode

QuestionQ12

Designing for security and compliance

Refer to the Helicopter Racing League (HRL) case study. Your team is responsible for creating a payment-card data vault for card numbers used to bill tens of thousands of viewers, merchandise consumers, and season ticket holders. You must implement a custom card-tokenization service that meets these requirements:

  • It must deliver low latency at minimal cost.
  • It must identify duplicate credit cards and must not retain plaintext card numbers.
  • It should support annual key rotation.

Which storage approach should you use for the tokenization service?

Explanation

Deterministic encryption yields the same ciphertext or token for each occurrence of the same card number, preserving referential integrity so duplicates can be identified without storing plaintext. Firestore in Datastore mode provides managed, scalable document storage with pay-per-use pricing, while Cloud KMS can maintain a scheduled annual rotation for the encryption key. Google Cloud Sensitive Data Protection documents deterministic AES-SIV encryption as preserving referential integrity for tokenization use cases.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!