E-Commerce Development Payment Processing 2 — Questions and Answers
Question 1: What is the purpose of a payment gateway's tokenization feature?
- To encrypt transaction logs for auditing
- To replace sensitive card data with a non-sensitive token (Correct answer)
- To generate one-time passwords for 2FA
- To compress payment data for faster transmission
Correct answer: To replace sensitive card data with a non-sensitive token
Tokenization replaces sensitive card data with a unique token so merchants never store raw card numbers, reducing PCI DSS scope.
Question 2: Which HTTP status code should a payment API return when a card is declined?
- 200 OK
- 402 Payment Required (Correct answer)
- 403 Forbidden
- 500 Internal Server Error
Correct answer: 402 Payment Required
HTTP 402 Payment Required is semantically correct for declined payment scenarios in REST APIs.
Question 3: What does AVS (Address Verification System) verify during a card transaction?
- The CVV code on the back of the card
- The billing address provided matches the card issuer's records (Correct answer)
- The cardholder's email address
- The shipping address is deliverable
Correct answer: The billing address provided matches the card issuer's records
AVS compares the billing address entered by the customer against the address on file with the card-issuing bank to help detect fraud.
Question 4: In Stripe's payment flow, what object represents a customer's intent to pay and tracks the payment lifecycle?
- PaymentMethod
- Charge
- PaymentIntent (Correct answer)
- Invoice
Correct answer: PaymentIntent
A PaymentIntent tracks the full lifecycle of a payment attempt in Stripe, including authentication steps and final confirmation.
Question 5: What is the primary risk of using a direct server-to-server card submission instead of a hosted payment page?
- Slower transaction speeds
- Increased PCI DSS compliance scope for the merchant (Correct answer)
- Higher payment processing fees
- Reduced support for international cards
Correct answer: Increased PCI DSS compliance scope for the merchant
Handling raw card data server-side puts the merchant in scope for PCI DSS SAQ D, requiring extensive security controls.
Question 6: Which of the following is a characteristic of an idempotent payment API request?
- Each call always creates a new charge regardless of prior calls
- Retrying with the same idempotency key returns the original result without double-charging (Correct answer)
- The request automatically retries on network failure
- The API ignores duplicate requests silently without response
Correct answer: Retrying with the same idempotency key returns the original result without double-charging
Idempotent requests use a unique key so that retrying a failed request returns the original response instead of creating a duplicate charge.
Question 7: What is a 'soft decline' in payment processing?
- A permanent card block by the issuing bank
- A temporary decline that may succeed if retried (Correct answer)
- A decline due to suspected fraud that locks the account
- A partial approval for less than the requested amount
Correct answer: A temporary decline that may succeed if retried
A soft decline is a temporary failure (e.g., insufficient funds or bank timeout) where the transaction may succeed if retried later.
E-Commerce Development Payment Processing 2
What is the purpose of a payment gateway's tokenization feature?