CSI Security & Compliance 3 — Questions and Answers
Question 1: Which compliance regulation primarily governs the protection of cardholder data in payment processing systems?
- HIPAA
- SOX
- PCI DSS (Correct answer)
- FERPA
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) sets requirements for protecting cardholder data in payment card environments.
Question 2: During a penetration test on an integrated system, the tester finds an open Telnet port. Why is this a critical security concern?
- Telnet uses too much bandwidth
- Telnet transmits data including credentials in plaintext (Correct answer)
- Telnet is not routable across WANs
- Telnet requires elevated hardware resources
Correct answer: Telnet transmits data including credentials in plaintext
Telnet sends all data, including usernames and passwords, unencrypted, making it trivial for an attacker to intercept credentials via packet capture.
Question 3: A system integrator is asked to implement multi-factor authentication (MFA). Which combination represents true MFA?
- Username and password
- Password and security question
- PIN and fingerprint scan (Correct answer)
- Two different passwords
Correct answer: PIN and fingerprint scan
True MFA combines factors from different categories: something you know (PIN) and something you are (fingerprint), satisfying two distinct authentication factors.
Question 4: What is the role of a Certificate Authority (CA) in a Public Key Infrastructure (PKI)?
- To encrypt data between endpoints
- To issue and manage digital certificates that bind public keys to identities (Correct answer)
- To store private keys for all users
- To perform intrusion detection
Correct answer: To issue and manage digital certificates that bind public keys to identities
A CA is a trusted entity that issues digital certificates, validating the association between a public key and the identity of its owner.
Question 5: In the context of physical security for integrated systems, what is 'tailgating'?
- Monitoring network packets in real time
- An unauthorized person following an authorized person through a secured door (Correct answer)
- Attaching a rogue device to a network switch
- Cloning an access card remotely
Correct answer: An unauthorized person following an authorized person through a secured door
Tailgating is a physical security breach where an unauthorized individual gains access to a restricted area by following closely behind an authorized person.
Question 6: A regulatory audit requires demonstrating data retention policies. Which document type best satisfies this requirement?
- Network topology diagram
- Data classification and retention policy (Correct answer)
- System hardware inventory
- Incident response playbook
Correct answer: Data classification and retention policy
A data classification and retention policy formally defines how long different types of data must be kept and how they should be handled, satisfying audit requirements.
Question 7: Which attack method involves an adversary intercepting and potentially altering communication between two parties without their knowledge?
- DDoS attack
- SQL injection
- Man-in-the-middle (MitM) attack (Correct answer)
- Brute force attack
Correct answer: Man-in-the-middle (MitM) attack
A man-in-the-middle attack occurs when an attacker secretly intercepts and possibly modifies communications between two parties who believe they are communicating directly.
CSI Security & Compliance 3
Which compliance regulation primarily governs the protection of cardholder data in payment processing systems?