APRP Physical and Information Security 3

Question 1

A payments organization uses multi-factor authentication (MFA). Which combination correctly represents three different authentication factors?

Accepted Answer

Smart card, fingerprint, and one-time passcode

Answer

Smart card (something you have), fingerprint (something you are), and OTP (something you have/know) span three distinct factor categories.

Question 2

Which attack exploits physical proximity to skim contactless payment card data without the cardholder's knowledge?

Accepted Answer

RFID/NFC eavesdropping

Answer

RFID/NFC eavesdropping captures contactless card data from a short distance using a covert reader.

Question 3

What is the purpose of a Hardware Security Module (HSM) in a payment processing environment?

Accepted Answer

To securely generate, store, and manage cryptographic keys

Answer

An HSM is a tamper-resistant physical device that manages cryptographic keys and performs encryption operations securely.

Question 4

Under PCI DSS, which media type requires secure destruction when no longer needed to protect cardholder data?

Accepted Answer

All physical and electronic media containing cardholder data

Answer

PCI DSS Requirement 9 requires secure destruction of all media types — paper, electronic, optical — that contain cardholder data.

Question 5

An employee working from home accesses the corporate payment platform. Which control is MOST important to mandate?

Accepted Answer

VPN with MFA connecting to the corporate network

Answer

A VPN with MFA ensures encrypted, authenticated access to payment systems from remote locations.

APRP - Accredited Payments Risk Professional Practice Test