APRP Data Security & Privacy 2

Question 1

A payment organization suffers a data breach exposing cardholder data. Which entity must be notified immediately under card network rules?

Accepted Answer

The acquiring bank and card networks (e.g., Visa, Mastercard)

Answer

Card network rules require immediate notification of the acquiring bank and the relevant card networks when a breach involving cardholder data is discovered.

Question 2

What is the role of a Qualified Security Assessor (QSA) in the PCI DSS compliance process?

Accepted Answer

To independently assess and validate an organization's compliance with PCI DSS requirements

Answer

A QSA is a company certified by the PCI SSC to independently assess an organization's PCI DSS compliance and validate its Report on Compliance (ROC).

Question 3

Which of the following describes a 'skimming' attack in the context of payment data security?

Accepted Answer

The theft of card data by attaching a covert device to a payment terminal or ATM

Answer

Skimming involves attaching a covert device to a payment terminal or ATM to capture magnetic stripe data from cards as they are swiped.

Question 4

Under the GLBA Safeguards Rule, what must a financial institution's information security program include?

Accepted Answer

A designated information security officer and a risk-based written information security program

Answer

The GLBA Safeguards Rule requires financial institutions to designate a qualified individual to oversee an information security program and implement safeguards based on a risk assessment.

Question 5

What is 'point-to-point encryption' (P2PE) in payment security?

Accepted Answer

Encryption of cardholder data from the point of interaction to a secure decryption environment, preventing interception

Answer

P2PE encrypts cardholder data immediately at the point of capture and keeps it encrypted until it reaches a secure decryption environment, preventing data from being usable if intercepted.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Data Security & Privacy 2