APRP Data Security & Privacy 5

Question 1

A payments company discovers that a rogue employee has been exfiltrating cardholder data for six months. Which FIRST step best aligns with PCI DSS incident response requirements?

Accepted Answer

Contain the breach and preserve forensic evidence

Answer

PCI DSS Requirement 12.10 mandates that the first incident response priority is containment and evidence preservation to limit damage and support forensic analysis.

Question 2

What is the primary security advantage of using point-to-point encryption (P2PE) in a retail payment environment?

Accepted Answer

It reduces the scope of PCI DSS compliance by removing clear-text card data from merchant systems

Answer

P2PE encrypts card data at the point of interaction and keeps it encrypted until it reaches the secure decryption environment, removing the merchant's systems from PCI DSS scope.

Question 3

Under HIPAA's intersection with payment data, which scenario would require BOTH PCI DSS and HIPAA compliance?

Accepted Answer

A healthcare provider accepting credit card payments for patient services

Answer

A healthcare provider that accepts credit card payments handles both cardholder data (PCI DSS) and protected health information (HIPAA), requiring compliance with both frameworks.

Question 4

An issuer wants to allow cardholders to freeze and unfreeze their cards instantly. Which security principle does this feature PRIMARILY support?

Accepted Answer

Dynamic authorization control

Answer

Card freeze/unfreeze gives cardholders dynamic control over transaction authorization, enabling real-time restriction of card use without cancellation.

Question 5

A payment fintech transfers European customer payment data to a US-based cloud provider. Under GDPR, which mechanism MOST commonly legitimizes this cross-border data transfer?

Accepted Answer

Standard Contractual Clauses (SCCs)

Answer

Standard Contractual Clauses (SCCs) are the most widely used GDPR-approved mechanism for transferring personal data from the EU to third countries lacking an adequacy decision.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Data Security & Privacy 5