APRP Physical and Information Security 4

Question 1

In payments security, what is 'data masking' PRIMARILY used for?

Accepted Answer

Replacing sensitive data with realistic but fictitious values in non-production environments

Answer

Data masking substitutes real cardholder data with realistic dummy values so developers and testers can work without exposing live account numbers.

Question 2

Which type of social engineering attack targets specific high-value individuals within a payments organization, such as the CFO or CTO?

Accepted Answer

Spear phishing (whaling)

Answer

Whaling is a targeted spear phishing attack aimed at senior executives to authorize fraudulent payments or disclose credentials.

Question 3

A rogue employee copies cardholder data to a personal thumb drive before leaving the company. Which control would BEST have prevented this?

Accepted Answer

Data Loss Prevention (DLP) tools with USB port blocking

Answer

DLP with USB port control prevents unauthorized copying of sensitive data to removable media.

Question 4

PCI DSS requires that all default passwords on payment system components be changed. Why is this critical?

Accepted Answer

Default passwords are publicly known and easily exploited by attackers

Answer

Default credentials are documented in vendor manuals and widely known; leaving them unchanged is one of the most common and easily exploited vulnerabilities.

Question 5

What is the primary security benefit of using point-to-point encryption (P2PE) in a card-present payment environment?

Accepted Answer

It encrypts cardholder data immediately at the point of interaction, preventing merchant systems from ever seeing plaintext card data

Answer

P2PE encrypts card data at the terminal before it reaches merchant systems, greatly reducing the risk of cardholder data theft and PCI DSS scope.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Physical and Information Security 4