APRP Data Security & Privacy 4

Question 1

Under the GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 2

A payment processor stores cardholder data in a database. Under PCI DSS, which of the following elements is NEVER permitted to be stored after authorization?

Accepted Answer

Full magnetic stripe data

Answer

PCI DSS prohibits storage of sensitive authentication data including full magnetic stripe (track) data even if encrypted, after transaction authorization.

Question 3

Which encryption mode is considered most appropriate for encrypting large volumes of payment data at rest because it allows parallel processing and does not propagate errors?

Accepted Answer

Counter Mode (CTR)

Answer

Counter (CTR) mode converts a block cipher into a stream cipher, supports parallel encryption/decryption, and errors do not propagate across blocks.

Question 4

A merchant's point-of-sale terminal is compromised via a RAM-scraping malware attack. Which data is MOST at risk during this type of attack?

Accepted Answer

Cardholder data in clear text during transaction processing

Answer

RAM-scraping malware captures card data from system memory at the moment it is decrypted for processing, before it can be re-encrypted or tokenized.

Question 5

Under the California Consumer Privacy Act (CCPA), which of the following rights does NOT apply to business-to-business (B2B) commercial data?

Accepted Answer

Right to know what personal information is collected

Answer

CCPA originally provided a B2B exemption, meaning information collected in a B2B context is not subject to the same consumer rights as B2C data, though exemptions have evolved.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Data Security & Privacy 4