APRP Physical and Information Security 2

Question 1

Which control is MOST effective at preventing tailgating (piggybacking) into a secure payments data center?

Accepted Answer

Mantrap/airlock entry vestibule

Answer

A mantrap forces one person at a time to badge through two doors, physically preventing tailgating.

Question 2

Under PCI DSS, how long must video surveillance footage from cardholder data environment entry points be retained?

Accepted Answer

90 days

Answer

PCI DSS Requirement 9 mandates that physical security camera footage be retained for at least 90 days.

Question 3

A payments processor discovers an unknown USB device plugged into a point-of-sale terminal. What is the FIRST action to take?

Accepted Answer

Remove the device and preserve it as evidence

Answer

Removing and preserving the device maintains the chain of custody for forensic investigation without introducing further risk.

Question 4

Which encryption standard is required by PCI DSS for protecting stored cardholder data at rest?

Accepted Answer

AES-256 or equivalent strong cryptography

Answer

PCI DSS requires strong cryptography such as AES-256 for protecting stored cardholder data.

Question 5

What does the principle of 'clean desk policy' PRIMARILY address in a payments security context?

Accepted Answer

Preventing unauthorized access to sensitive documents and media left unattended

Answer

A clean desk policy reduces the risk of sensitive cardholder data or credentials being seen or taken by unauthorized individuals.

APRP - Accredited Payments Risk Professional Practice Test