Answer: Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.

Option B is the correct answer because it directly addresses both requirements: minimizing PII exposure while preserving the format of credit card PANs for testing. The Cloud Data Loss Prevention (DLP) API can scan and redact PII (e.g., names, addresses), and format-preserving encryption (FPE) encrypts the PAN while maintaining its original structure (e.g., 16-digit number), allowing the development team to validate format checks without exposing real data. Option A (Confidential Computing) encrypts data in use but does not redact PII or ensure format preservation, leaving sensitive data accessible. Option C (Cloud KMS encryption) protects data at rest but does not address format requirements or PII redaction. Option D (building a custom tool) is inefficient and error-prone compared to using managed services like DLP API and FPE, which are designed for de-identification and encryption with format preservation. The community discussion strongly supports B (71% consensus), with upvoted comments emphasizing that B meets the dual needs of data protection and format integrity, while A fails to redact PII or preserve formats.

Author: LeetQuiz Editorial Team