Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ12

Designing for security and compliance

Refer to the Helicopter Racing League (HRL) case study. Your team is responsible for creating a payment-card data vault for card numbers used to bill tens of thousands of viewers, merchandise consumers, and season ticket holders. You must implement a custom card-tokenization service that meets these requirements:

  • It must deliver low latency at minimal cost.
  • It must identify duplicate credit cards and must not retain plaintext card numbers.
  • It should support annual key rotation.

Which storage approach should you use for the tokenization service?

  • A Store the card data in Secret Manager after running a query to identify duplicates.
  • B Encrypt the card data with a deterministic algorithm stored in Firestore using Datastore mode.
  • C Encrypt the card data with a deterministic algorithm and shard it across multiple Memorystore instances.
  • D Use column-level encryption to store the data in Cloud SQL.
Explanation

Deterministic encryption yields the same ciphertext or token for each occurrence of the same card number, preserving referential integrity so duplicates can be identified without storing plaintext. Firestore in Datastore mode provides managed, scalable document storage with pay-per-use pricing, while Cloud KMS can maintain a scheduled annual rotation for the encryption key. Google Cloud Sensitive Data Protection documents deterministic AES-SIV encryption as preserving referential integrity for tokenization use cases.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!