APRP Physical and Information Security 5

Question 1

An organization discovers that a former employee's badge still grants access to the payments server room one month after termination. Which process failed?

Accepted Answer

Access revocation as part of the offboarding process

Answer

Timely revocation of physical and logical access during employee offboarding is a fundamental control to prevent unauthorized access by former staff.

Question 2

Which concept requires that no single individual can complete a sensitive payment transaction or system change without involvement from at least one other person?

Accepted Answer

Separation of duties

Answer

Separation of duties splits critical tasks between two or more individuals to prevent fraud and errors by any single person.

Question 3

A payment company's intrusion detection system (IDS) generates hundreds of alerts daily, but staff rarely investigate them. This BEST illustrates which risk?

Accepted Answer

Alert fatigue leading to missed real security events

Answer

Alert fatigue occurs when too many low-priority alerts cause analysts to overlook or ignore genuinely critical security events.

Question 4

Which of the following BEST describes the purpose of a penetration test in a payments security program?

Accepted Answer

To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do

Answer

Penetration testing proactively identifies and validates security weaknesses by mimicking the tactics of actual attackers.

Question 5

Under PCI DSS, what is the requirement for protecting cryptographic keys used to encrypt cardholder data?

Accepted Answer

Keys must be stored securely and access restricted to the fewest custodians necessary, with key-management procedures documented

Answer

PCI DSS Requirement 3 mandates strict key management including secure storage, limited access, and documented procedures for the full key lifecycle.

APRP - Accredited Payments Risk Professional Practice Test

APRP - Accredited Payments Risk Professional Practice Test

APRP Physical and Information Security 5