Medium1 markMultiple Choice
Subtask 3.2: Compliance DesignSecurityComplianceCloud DLPPCI-DSS
This question is part of a case study — click to read the full scenario(Case 06)

CASE STUDY: RetailMart

Overview:
Industry: Retail/E-commerce
Size: 2000 employees, $500M revenue

Environment:

  • Monolithic Java app on VMware
  • Oracle RAC DB
  • F5 Load Balancers
  • 10 Gbps Direct Connect to AWS

Requirements:

  • CapEx to OpEx
  • Handle 10x Black Friday traffic
  • Personalized recommendations
  • Modernize without impacting sales

Exec Statements:

  • CEO: Omnichannel experience.
  • CFO: Predictable costs, no hardware refresh.
  • CTO: Break monolith, but Oracle DB stays on-prem for 2 years.

Tech Reqs:

  • Zero downtime deployments
  • PCI-DSS compliance
  • Image processing pipeline
  • Async order processing

Constraints:

  • Hybrid architecture required
  • Team knows Spring Boot, zero Kubernetes exp
  • 6-month timeline

QUESTION: The CTO requires the Oracle database to remain on-premises while the application moves to GCP. Which hybrid connectivity solution should you implement to ensure high throughput and low latency?

GCP PCA · Question 10 · Compliance Design

CASE STUDY: RetailMart

Overview:
Industry: Retail/E-commerce
Size: 2000 employees, $500M revenue

Environment:

  • Monolithic Java app on VMware
  • Oracle RAC DB
  • F5 Load Balancers
  • 10 Gbps Direct Connect to AWS

Requirements:

  • CapEx to OpEx
  • Handle 10x Black Friday traffic
  • Personalized recommendations
  • Modernize without impacting sales

Exec Statements:

  • CEO: Omnichannel experience.
  • CFO: Predictable costs, no hardware refresh.
  • CTO: Break monolith, but Oracle DB stays on-prem for 2 years.

Tech Reqs:

  • Zero downtime deployments
  • PCI-DSS compliance
  • Image processing pipeline
  • Async order processing

Constraints:

  • Hybrid architecture required
  • Team knows Spring Boot, zero Kubernetes exp
  • 6-month timeline

QUESTION: To meet the PCI-DSS compliance requirement, how should you handle credit card numbers entered by users?

Answer options:

A.

Encrypt the database volumes using Google-managed encryption keys (GMEK).

B.

Hash the credit card numbers using SHA-256 before storing them.

C.

Use the Cloud Data Loss Prevention (DLP) API to tokenize the credit card numbers before storing them.

D.

Store the credit card numbers in a separate Cloud SQL instance in a different VPC.

How to approach this question

Identify the GCP service specifically designed to discover, classify, and protect sensitive data like credit card numbers.

Full Answer

C.Use the Cloud Data Loss Prevention (DLP) API to tokenize the credit card numbers before storing them.✓ Correct
Use the Cloud Data Loss Prevention (DLP) API to tokenize the credit card numbers before storing them.
Cloud DLP (now Sensitive Data Protection) provides tokenization (format-preserving encryption). By tokenizing credit card numbers at the edge before they enter the main application architecture, you significantly reduce the scope and cost of PCI-DSS compliance audits.

Common mistakes

Assuming default encryption at rest (A) is sufficient for PCI-DSS application-level requirements.

Practice the full GCP Professional Cloud Architect Practice Exam 6

50 questions · hints · full answers · grading

More questions from this exam