Exercise 2: What a Token Actually Represents — Possible Solution
====================================================================

WHAT A TOKEN IS
------------------------------
Per this chapter, a token (e.g. a Stripe PaymentMethod ID like
"pm_1N...") is a one-time stand-in value that Stripe's own
JavaScript (Stripe.js) generates from the card details entered inside
Stripe's own isolated, embedded fields - it represents the card
without containing the actual card number itself in any form the
store's own code ever reads.

WHY THE SERVER RECEIVING ONLY A TOKEN IS THE KEY DETAIL
------------------------------
Per this chapter's own conceptual code example, the store's server
receives $_POST['stripe_payment_method_id'] - a token - and passes it
to Stripe's own API to create a payment. At no point does the store's
server "ever read, log, or store an actual card number," as the
chapter states directly. PCI-DSS scope is defined by whether a system
stores, processes, or transmits cardholder data - since the token
itself is not cardholder data, the store's server never becomes such
a system in the first place.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains what a token is and where it comes from, and
correctly connects "the server only ever sees a token" to the actual
legal/technical definition of PCI-DSS scope, rather than treating the
compliance benefit as some separate, unexplained rule.