APRP Data Security & Privacy 4 — Questions and Answers
Question 1: Under the GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 2: A payment processor stores cardholder data in a database. Under PCI DSS, which of the following elements is NEVER permitted to be stored after authorization?
- Primary Account Number (PAN)
- Cardholder name
- Full magnetic stripe data (Correct answer)
- Expiration date
Correct answer: Full magnetic stripe data
PCI DSS prohibits storage of sensitive authentication data including full magnetic stripe (track) data even if encrypted, after transaction authorization.
Question 3: Which encryption mode is considered most appropriate for encrypting large volumes of payment data at rest because it allows parallel processing and does not propagate errors?
- Cipher Block Chaining (CBC)
- Electronic Codebook (ECB)
- Counter Mode (CTR) (Correct answer)
- Output Feedback (OFB)
Correct answer: Counter Mode (CTR)
Counter (CTR) mode converts a block cipher into a stream cipher, supports parallel encryption/decryption, and errors do not propagate across blocks.
Question 4: A merchant's point-of-sale terminal is compromised via a RAM-scraping malware attack. Which data is MOST at risk during this type of attack?
- Encrypted data stored in the database
- Cardholder data in clear text during transaction processing (Correct answer)
- Tokenized card numbers in the payment gateway
- Hashed PINs stored on the host system
Correct answer: Cardholder data in clear text during transaction processing
RAM-scraping malware captures card data from system memory at the moment it is decrypted for processing, before it can be re-encrypted or tokenized.
Question 5: Under the California Consumer Privacy Act (CCPA), which of the following rights does NOT apply to business-to-business (B2B) commercial data?
- Right to know what personal information is collected (Correct answer)
- Right to opt out of sale
- Right to deletion
- Right to non-discrimination
Correct answer: Right to know what personal information is collected
CCPA originally provided a B2B exemption, meaning information collected in a B2B context is not subject to the same consumer rights as B2C data, though exemptions have evolved.
Question 6: A company uses a third-party payment processor. Under the principle of data minimization, what is the BEST approach to handling customer data shared with the processor?
- Share all available customer data for fraud analytics
- Share only the data fields strictly necessary to complete the transaction (Correct answer)
- Encrypt the full customer profile before sharing
- Allow the processor to decide what data they need
Correct answer: Share only the data fields strictly necessary to complete the transaction
Data minimization requires sharing only the minimum necessary data to fulfill the specific processing purpose, reducing exposure in the event of a breach.
Question 7: Which of the following BEST describes the purpose of a Data Processing Agreement (DPA) in a payment ecosystem?
- It sets pricing terms between merchant and acquirer
- It defines how a data processor must handle personal data on behalf of the controller (Correct answer)
- It outlines PCI DSS compliance obligations for merchants
- It establishes interchange rates between card networks and issuers
Correct answer: It defines how a data processor must handle personal data on behalf of the controller
A DPA is a legally binding contract that specifies the data processor's obligations when processing personal data on behalf of the data controller, as required by GDPR Article 28.
APRP Data Security & Privacy 4
Under the GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach?