APRP Data Security & Privacy 5 — Questions and Answers
Question 1: A payments company discovers that a rogue employee has been exfiltrating cardholder data for six months. Which FIRST step best aligns with PCI DSS incident response requirements?
- Immediately notify all affected cardholders
- Contain the breach and preserve forensic evidence (Correct answer)
- Terminate the employee and reset all passwords
- File a police report before taking any internal action
Correct answer: Contain the breach and preserve forensic evidence
PCI DSS Requirement 12.10 mandates that the first incident response priority is containment and evidence preservation to limit damage and support forensic analysis.
Question 2: What is the primary security advantage of using point-to-point encryption (P2PE) in a retail payment environment?
- It eliminates the need for a PCI DSS assessment entirely
- It reduces the scope of PCI DSS compliance by removing clear-text card data from merchant systems (Correct answer)
- It replaces tokenization and removes the need for a token vault
- It encrypts data at the acquiring bank before settlement
Correct answer: It reduces the scope of PCI DSS compliance by removing clear-text card data from merchant systems
P2PE encrypts card data at the point of interaction and keeps it encrypted until it reaches the secure decryption environment, removing the merchant's systems from PCI DSS scope.
Question 3: Under HIPAA's intersection with payment data, which scenario would require BOTH PCI DSS and HIPAA compliance?
- A retailer processing credit card payments at checkout
- A healthcare provider accepting credit card payments for patient services (Correct answer)
- A bank issuing payment cards to hospital employees
- A payment gateway routing transactions for a pharmacy benefit manager
Correct answer: A healthcare provider accepting credit card payments for patient services
A healthcare provider that accepts credit card payments handles both cardholder data (PCI DSS) and protected health information (HIPAA), requiring compliance with both frameworks.
Question 4: An issuer wants to allow cardholders to freeze and unfreeze their cards instantly. Which security principle does this feature PRIMARILY support?
- Non-repudiation
- Least privilege
- User-controlled data minimization
- Dynamic authorization control (Correct answer)
Correct answer: Dynamic authorization control
Card freeze/unfreeze gives cardholders dynamic control over transaction authorization, enabling real-time restriction of card use without cancellation.
Question 5: A payment fintech transfers European customer payment data to a US-based cloud provider. Under GDPR, which mechanism MOST commonly legitimizes this cross-border data transfer?
- Data Processing Agreement only
- Standard Contractual Clauses (SCCs) (Correct answer)
- Binding Corporate Rules (BCRs) approved by the FTC
- Safe Harbor framework
Correct answer: Standard Contractual Clauses (SCCs)
Standard Contractual Clauses (SCCs) are the most widely used GDPR-approved mechanism for transferring personal data from the EU to third countries lacking an adequacy decision.
Question 6: During a PCI DSS audit, an assessor finds that an e-commerce merchant logs full PANs in application error logs. What is the MOST appropriate remediation?
- Encrypt the log files using AES-256
- Modify the application to mask or truncate PANs in all log outputs (Correct answer)
- Restrict log file access to system administrators only
- Move log files to an out-of-scope network segment
Correct answer: Modify the application to mask or truncate PANs in all log outputs
PCI DSS Requirement 3.3 prohibits storing sensitive authentication data and requires that PANs be masked when displayed; modifying the application to prevent logging full PANs is the correct fix.
Question 7: Which of the following BEST characterizes the difference between pseudonymization and anonymization in the context of payment data privacy?
- Pseudonymization is irreversible; anonymization can be reversed with a key
- Anonymization is irreversible; pseudonymized data can be re-identified with additional information (Correct answer)
- Both are fully reversible processes used for data masking
- Pseudonymization removes all personal identifiers permanently
Correct answer: Anonymization is irreversible; pseudonymized data can be re-identified with additional information
Anonymization permanently removes the ability to re-identify individuals, while pseudonymization replaces identifiers with a pseudonym that can be reversed using a separate key or mapping.
APRP Data Security & Privacy 5
A payments company discovers that a rogue employee has been exfiltrating cardholder data for six months.
Which FIRST step best aligns with PCI DSS incident response requirements?