Protecting Test Data While Preserving Credit Card Formats | PCSE

PCSE By islever Editorial Last updated

Short answer

B Use Cloud DLP to scan and redact PII while applying format-preserving encryption to protect card PANs during testing.

Question

Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?
  1. Run the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
  2. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN. Correct Answer
  3. Encrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
  4. Build a tool to replace the card PAN and PII fields with randomly generated values.

Key Takeaways

The question tests secure data handling for development environments, where candidates often overlook that standard encryption breaks format-dependent validation logic.

Format-preserving encryption and Cloud DLP enable secure test data generation that maintains original data structures. This guide explains why these tools correctly balance PCI compliance with application validation requirements.

Common mistake: Choosing confidential computing or standard KMS encryption fails because both alter data formats, causing format-checking features to reject the test records entirely.

Expert Analysis

Why the Answer Is Correct

Format-preserving encryption (FPE) encrypts sensitive fields like primary account numbers while maintaining their original length, character set, and structural patterns. When combined with Cloud DLP scanning and redaction, this approach strips unprotected personally identifiable information before the dataset reaches the testing environment. The resulting records pass the new feature’s format validation rules without exposing live financial data. This aligns directly with Google Cloud’s recommended architecture for secure software testing and PCI-DSS compliance.

Why the Other Options Are Wrong

Confidential computing secures data during processing but does not modify or mask the underlying dataset, leaving raw PII accessible to developers. Standard KMS encryption transforms data into binary ciphertext, which immediately breaks any string-based format checks required by the application. Generating completely random values violates the format-checking requirement because synthetic numbers typically fail checksum algorithms like Luhn. Each alternative either ignores the security mandate or breaks the functional testing constraint.

Community Comment Notes

Several learners highlighted that format preservation is the deciding factor, noting that standard encryption breaks validation logic. As brpjp stated, 'By encrypting you will not preserve the format.' Another commenter emphasized that combining DLP redaction with FPE directly satisfies both security and testing needs. Consensus strongly favors this dual approach for production-grade test datasets.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always verify whether a new application feature depends on data structure or format before selecting a masking or encryption strategy. Choose solutions that preserve original patterns when validation logic relies on checksums, length constraints, or regex rules.

Frequently Asked Questions

Why can't standard KMS encryption be used for test PANs?

Standard encryption changes data length and character sets, causing format-checking logic to reject the records during testing.

Does format-preserving encryption meet PCI-DSS requirements?

Yes, FPE provides strong cryptographic protection while retaining necessary data formats for compliant development workflows.

More PCSE FAQ →

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. brpjp 👍 4
    Answer B is correct. A - is missing this requirement - The new feature includes format checking on the primary account number (PAN) of a credit card. By encrypting you will not preserve the format.
  2. Pime13 👍 1 Answered B
    https://cloud.google.com/architecture/de-identification-re-identification-pii-using-cloud-dlp https://cloud.google.com/blog/products/identity-security/taking-charge-of-your-data-using-cloud-dlp-to-de-identify-and-obfuscate-sensitive-information. Using the Cloud Data Loss Prevention (DLP) API to scan and redact PII, combined with format-preserving encryption, directly addresses the need to protect sensitive data while maintaining the necessary format for testing. This ensures that the development team can perform their tests without exposing real PII.
  3. KLei 👍 1 Answered B
    A (Confidential Computing) may not directly address the need to redact and protect PII before testing.
  4. Ponchi14 👍 1 Answered A
    A is correct. Redacting PII beats the purposed of using real transaction records
  5. koo_kai 👍 2 Answered B
    format check
Show 2 more comments
  1. yokoyan 👍 1 Answered A
    I think it's A.
  2. dat987 👍 1 Answered B
    I think B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide