APRP Data Security & Privacy 3

Question 1

A payment processor discovers that a developer included live PANs in application log files. What is the most critical immediate action?

Accepted Answer

Purge the log files containing live PANs and remediate the logging code to prevent recurrence

Answer

Archive the log files for future audit review

Answer

Notify customers that their data may appear in logs

Answer

Rotate the encryption keys used for PAN storage

Question 2

What distinguishes data masking from data encryption in a payment environment?

Accepted Answer

Masking replaces data with non-sensitive characters for display, while encryption scrambles data in a reversible way using a key

Answer

Masking is reversible with a key, while encryption permanently removes data

Answer

Encryption is only used for data in transit, while masking is used for data at rest

Answer

Masking is required by PCI DSS, while encryption is optional for compliant entities

Question 3

Under the California Consumer Privacy Act (CCPA), what right do California consumers have regarding their personal data collected by businesses?

Accepted Answer

The right to know what personal information is collected, to delete it, and to opt out of its sale

Answer

The right to receive payment in exchange for their data

Answer

The right to require businesses to store their data only in California

Answer

The right to sue any business that uses their data for marketing purposes

Question 4

Which of the following is the best example of a detective control for data security in a payment environment?

Accepted Answer

Implementing file integrity monitoring to alert on unauthorized changes to cardholder data systems

Answer

Encrypting PANs before storing them in a database

Answer

Requiring two-factor authentication for all system administrators

Answer

Segmenting the cardholder data environment from the corporate network

Question 5

What is 'data minimization' as it applies to payment privacy risk management?

Accepted Answer

Collecting and retaining only the personal and payment data that is strictly necessary for the intended business purpose

Answer

Reducing the number of payment fields on checkout forms to improve conversion rates

Answer

Compressing payment transaction data to reduce storage costs

Answer

Limiting the number of payment methods offered to customers

Question 6

A payment organization receives a subpoena for cardholder transaction records. Which principle should guide how much data is produced in response?

Accepted Answer

Produce only the data specifically requested and legally required, consistent with data minimization and privacy obligations

Answer

Produce all available cardholder data to demonstrate full cooperation

Answer

Refuse to produce any data until a court order is issued

Answer

Transfer all relevant data to the requesting authority's system immediately