APRP Data Security & Privacy 2

Question 1

A payment organization suffers a data breach exposing cardholder data. Which entity must be notified immediately under card network rules?

Accepted Answer

The acquiring bank and card networks (e.g., Visa, Mastercard)

Answer

Only the affected cardholders directly

Answer

The Federal Reserve Board exclusively

Answer

The organization's external auditors

Question 2

What is the role of a Qualified Security Assessor (QSA) in the PCI DSS compliance process?

Accepted Answer

To independently assess and validate an organization's compliance with PCI DSS requirements

Answer

To approve new payment card designs for card networks

Answer

To process chargebacks on behalf of issuing banks

Answer

To set PCI DSS standards on behalf of the PCI Security Standards Council

Question 3

Which of the following describes a 'skimming' attack in the context of payment data security?

Accepted Answer

The theft of card data by attaching a covert device to a payment terminal or ATM

Answer

A phishing email campaign targeting payment card customers

Answer

A man-in-the-middle attack intercepting online payment transactions

Answer

Social engineering of call center agents to obtain cardholder details

Question 4

Under the GLBA Safeguards Rule, what must a financial institution's information security program include?

Accepted Answer

A designated information security officer and a risk-based written information security program

Answer

A written policy prohibiting all third-party data sharing

Answer

Annual PCI DSS certification by a Qualified Security Assessor

Answer

Real-time monitoring of all customer transactions for fraud

Question 5

What is 'point-to-point encryption' (P2PE) in payment security?

Accepted Answer

Encryption of cardholder data from the point of interaction to a secure decryption environment, preventing interception

Answer

Encryption of data at rest within the issuer's core banking system

Answer

Two-way authentication between a cardholder and their issuing bank

Answer

A VPN tunnel between a merchant's POS system and the acquirer

Question 6

Which PCI DSS requirement specifically addresses the need to regularly test security systems and processes?

Accepted Answer

Requirement 11: Test security of systems and networks regularly

Answer

Requirement 3: Protect stored account data

Answer

Requirement 6: Develop and maintain secure systems and software

Answer

Requirement 12: Support information security with organizational policies and programs