APRP Data Security & Privacy 3

Question 1

A payment processor discovers that a developer included live PANs in application log files. What is the most critical immediate action?

Accepted Answer

Purge the log files containing live PANs and remediate the logging code to prevent recurrence

Answer

Log files containing live PANs must be immediately purged and the application code fixed to prevent future logging of sensitive data, as this violates PCI DSS Requirement 3.

Question 2

What distinguishes data masking from data encryption in a payment environment?

Accepted Answer

Masking replaces data with non-sensitive characters for display, while encryption scrambles data in a reversible way using a key

Answer

Data masking replaces portions of sensitive data (e.g., showing only last four digits of a PAN) for display purposes, while encryption transforms the full data into ciphertext that can be reversed with the proper key.

Question 3

Under the California Consumer Privacy Act (CCPA), what right do California consumers have regarding their personal data collected by businesses?

Accepted Answer

The right to know what personal information is collected, to delete it, and to opt out of its sale

Answer

The CCPA grants California consumers the right to know what personal information is collected and used, the right to request deletion, and the right to opt out of the sale of their personal information.

Question 4

Which of the following is the best example of a detective control for data security in a payment environment?

Accepted Answer

Implementing file integrity monitoring to alert on unauthorized changes to cardholder data systems

Answer

File integrity monitoring detects unauthorized changes after they occur, making it a detective control that triggers alerts when cardholder data system files are modified.

Question 5

What is 'data minimization' as it applies to payment privacy risk management?

Accepted Answer

Collecting and retaining only the personal and payment data that is strictly necessary for the intended business purpose

Answer

Data minimization is the privacy principle of collecting, using, and retaining only the minimum personal and payment data necessary for a specific, lawful purpose.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Data Security & Privacy 3