E-Commerce Development Payment Processing 2

Question 1

What is the purpose of a payment gateway's tokenization feature?

Accepted Answer

To replace sensitive card data with a non-sensitive token

Answer

Tokenization replaces sensitive card data with a unique token so merchants never store raw card numbers, reducing PCI DSS scope.

Question 2

Which HTTP status code should a payment API return when a card is declined?

Accepted Answer

402 Payment Required

Answer

HTTP 402 Payment Required is semantically correct for declined payment scenarios in REST APIs.

Question 3

What does AVS (Address Verification System) verify during a card transaction?

Accepted Answer

The billing address provided matches the card issuer's records

Answer

AVS compares the billing address entered by the customer against the address on file with the card-issuing bank to help detect fraud.

Question 4

In Stripe's payment flow, what object represents a customer's intent to pay and tracks the payment lifecycle?

Accepted Answer

PaymentIntent

Answer

A PaymentIntent tracks the full lifecycle of a payment attempt in Stripe, including authentication steps and final confirmation.

Question 5

What is the primary risk of using a direct server-to-server card submission instead of a hosted payment page?

Accepted Answer

Increased PCI DSS compliance scope for the merchant

Answer

Handling raw card data server-side puts the merchant in scope for PCI DSS SAQ D, requiring extensive security controls.

E-Commerce Development Practice Test