Payment Card Industry Professional (PCIP) Certification Exam — Questions and Answers

Question 1: What does 'scoping' mean in the context of a PCI DSS assessment?

Identifying all system components that must comply with PCI DSS (Correct answer)
Determining the physical location of the assessment
Selecting which SAQ type to use
Scheduling the QSA's on-site visit

Correct answer: Identifying all system components that must comply with PCI DSS

Scoping is the process of identifying all system components, people, and processes included in or connected to the cardholder data environment that are subject to PCI DSS requirements.

Question 2: Which of the following actions is considered a violation of proper incident response evidence handling procedures?

Photographing the screen before shutting down a suspect system
Creating a write-protected forensic image before analysis
Running antivirus scans directly on the original compromised drive (Correct answer)
Documenting all actions taken on compromised systems

Correct answer: Running antivirus scans directly on the original compromised drive

Running antivirus or any tool directly on the original compromised drive can alter or destroy evidence; always work from a forensic copy.

Question 3: Under PCI DSS, what must be done with all unnecessary services, protocols, and ports on systems in the CDE?

They must be documented in a risk register
They must be encrypted
They must be disabled or removed (Correct answer)
They must be monitored continuously

Correct answer: They must be disabled or removed

PCI DSS Requirement 2 requires that all unnecessary services, protocols, daemons, and ports be disabled or removed to reduce the attack surface.

Question 4: Which personal protective equipment (PPE) principle applies to ALL PCIP certified professionals regardless of their specific role?

Any PPE will provide adequate protection
PPE must be properly fitted, maintained, and replaced as needed (Correct answer)
PPE is only necessary during formal inspections
PPE is optional if experienced in the field

Correct answer: PPE must be properly fitted, maintained, and replaced as needed

Regardless of experience level or specific role, PPE must be properly fitted to the individual, regularly maintained in good condition, and replaced when worn or damaged. Improperly fitted or degraded PPE can provide a false sense of security.

Question 5: What is defense in depth in the context of PCIP security?

Focusing only on perimeter security
Implementing multiple layers of security controls (Correct answer)
Relying solely on encryption
Using one strong security control

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 6: A service provider that stores cardholder data on behalf of 50 merchants suffers a breach. Which entities are primarily responsible for notifying affected card brands?

The breached service provider and each merchant's acquirer (Correct answer)
Each of the 50 individual merchants separately
The card-issuing banks of affected cardholders
Only the federal government authorities

Correct answer: The breached service provider and each merchant's acquirer

Both the breached service provider and the acquirers of affected merchants share notification obligations to the card brands under PCI DSS breach response requirements.

Question 7: Which concept involves protecting data from unauthorized access?

Auditability
Availability
Integrity
Confidentiality (Correct answer)

Correct answer: Confidentiality

Confidentiality, a core principle of information security, involves protecting data from unauthorized access and disclosure. It ensures that sensitive information is only accessible to individuals or systems that have been explicitly authorized. Implementing measures like encryption, access controls, and strong authentication protocols helps maintain the confidentiality of data, preventing its exposure to unintended parties.

Question 8: A Level 3 merchant that processes between 20,000 and 1 million e-commerce transactions annually must complete which validation requirement?

No formal validation required
Biannual QSA assessment
Annual SAQ and quarterly network scans (Correct answer)
Annual on-site QSA assessment and ROC

Correct answer: Annual SAQ and quarterly network scans

Level 3 merchants must complete an annual SAQ and submit passing results from quarterly network vulnerability scans conducted by an approved ASV.

Question 9: Which cipher mode makes AES encryption deterministic and therefore unsuitable for encrypting PANs directly under PCI DSS guidance?

CTR
CBC
ECB (Correct answer)
GCM

Correct answer: ECB

ECB (Electronic Code Book) mode produces identical ciphertext for identical plaintext blocks, making it deterministic and cryptographically weak for PAN protection.

Question 10: Which merchant level requires an annual on-site assessment by a Qualified Security Assessor (QSA)?

Level 1 – more than 6 million transactions (Correct answer)
Level 4 – fewer than 20,000 e-commerce transactions
Level 2 – 1 to 6 million transactions
Level 3 – 20,000 to 1 million e-commerce transactions

Correct answer: Level 1 – more than 6 million transactions

Level 1 merchants (over 6 million transactions annually) are required to undergo a full annual on-site QSA assessment and produce a Report on Compliance (ROC).

Question 11: During a PCI DSS incident investigation, which log source is most critical for tracing unauthorized access to the cardholder data environment?

Authentication and access logs (Correct answer)
Application performance logs
Marketing analytics logs
Employee time-tracking logs

Correct answer: Authentication and access logs

Authentication and access logs reveal who accessed the cardholder data environment and when, making them essential for tracing unauthorized access.

Question 12: Which document typically outlines the compliance requirements for PCIP professionals?

Annual financial report
Employee handbook
Marketing brochure
Standards of practice and code of conduct (Correct answer)

Correct answer: Standards of practice and code of conduct

Standards of practice and codes of conduct define the professional and ethical requirements practitioners must follow.

Question 13: What is the primary purpose of a 'lessons learned' session conducted after resolving a payment card security incident?

To assign blame to responsible employees
To identify improvements to prevent recurrence (Correct answer)
To prepare the public press release
To calculate the financial cost of the breach

Correct answer: To identify improvements to prevent recurrence

Lessons learned sessions focus on identifying control gaps and process improvements to strengthen defenses and prevent similar incidents.

Question 14: Which action is required after a failed assessment?

Remediate and reassess (Correct answer)
Start over after one year
Report only part of the findings
Ignore the results

Correct answer: Remediate and reassess

If an organization fails a PCI DSS assessment, the required action is to remediate the identified non-compliance issues and then undergo a reassessment. Simply ignoring the results or waiting a year is not an option, as non-compliance can lead to fines, penalties, and potential loss of card processing privileges. The goal is to achieve full compliance to protect cardholder data.

Question 15: A Level 2 merchant transitions to Level 1 after processing volume increases. What new compliance reporting obligation is triggered?

An annual on-site assessment by a QSA producing a ROC (Correct answer)
Quarterly ASV scans are no longer required
Annual SAQ submission replaces the ROC
They must self-attest using SAQ D only

Correct answer: An annual on-site assessment by a QSA producing a ROC

Level 1 merchants must undergo an annual on-site assessment conducted by a QSA resulting in a Report on Compliance (ROC).

Question 16: Which technique do attackers commonly use to exfiltrate cardholder data without triggering data loss prevention tools?

Using unencrypted USB drives
Sending data in plaintext over HTTP
Emailing cardholder data to an internal address
Encoding data within DNS queries or HTTPS traffic (Correct answer)

Correct answer: Encoding data within DNS queries or HTTPS traffic

Attackers encode stolen data within legitimate-looking DNS queries or HTTPS traffic to blend with normal network activity and evade DLP detection.

Question 17: What is 'port scanning' used for in the context of PCI DSS network security assessments?

To verify firewall log integrity
To test wireless signal strength
To measure network bandwidth utilization
To identify open ports and services that may represent attack vectors (Correct answer)

Correct answer: To identify open ports and services that may represent attack vectors

Port scanning discovers open TCP/UDP ports and associated services, helping identify unnecessary or unauthorized network entry points that should be closed.

Question 18: A merchant uses a fully outsourced hosted payment page where they never receive or access cardholder data. Which SAQ type applies?

SAQ D
SAQ B
SAQ A (Correct answer)
SAQ C-VT

Correct answer: SAQ A

SAQ A applies to card-not-present merchants who have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers.

Question 19: Under PCI DSS, how long must an entity retain documentation related to a completed assessment (ROC, AOC, supporting evidence)?

5 years
1 year
6 months
At least 1 year, with some evidence retained longer per policy (Correct answer)

Correct answer: At least 1 year, with some evidence retained longer per policy

PCI DSS requires policies and procedures to be retained for at least 12 months, and entities should retain assessment documentation for at least the same period to support audit trails.

Question 20: A merchant's cardholder data environment (CDE) uses a flat network where all systems can communicate with each other. Which PCI DSS requirement is most directly violated?

Requirement 5 – Protect all systems against malware
Requirement 11 – Test security of systems and networks
Requirement 8 – Identify users and authenticate access
Requirement 1 – Install and maintain network security controls (Correct answer)

Correct answer: Requirement 1 – Install and maintain network security controls

Requirement 1 mandates network segmentation controls (firewalls/routers) to restrict traffic and isolate the CDE from untrusted networks.

Question 21: Which PCI DSS requirement mandates that a formal risk assessment be performed at least annually?

Requirement 8
Requirement 12 (Correct answer)
Requirement 10
Requirement 6

Correct answer: Requirement 12

PCI DSS Requirement 12.3 requires that a risk assessment be performed at least annually and upon significant changes to the environment.

Question 22: What is the primary purpose of network segmentation in a PCI DSS environment?

To simplify IP address management
To improve network performance
To reduce the scope of the cardholder data environment (Correct answer)
To enable easier patch management

Correct answer: To reduce the scope of the cardholder data environment

Network segmentation isolates the cardholder data environment (CDE) from other networks, reducing the number of systems subject to PCI DSS controls.

Question 23: Which statement about storing Sensitive Authentication Data (SAD) post-authorization is correct under PCI DSS?

SAD may be stored post-authorization if a documented business justification exists
SAD must never be stored after the authorization process is complete, regardless of encryption (Correct answer)
SAD may be stored by issuers but not by merchants or acquirers
SAD may be stored post-authorization only if it is encrypted with AES-256

Correct answer: SAD must never be stored after the authorization process is complete, regardless of encryption

PCI DSS prohibits storing SAD after authorization for all entities — this rule applies regardless of encryption or business need for merchants, service providers, and acquirers.

Question 24: Which factor should PCIP professionals consider first when choosing an assessment method?

Availability of the tool
Cost of the instrument
Appropriateness for the target population (Correct answer)
Ease of scoring

Correct answer: Appropriateness for the target population

The most important consideration is whether the assessment method is appropriate and validated for the specific population being assessed.

Question 25: Which of the following scenarios requires a merchant to immediately notify their acquiring bank outside of the normal annual reporting cycle?

Suspecting a cardholder data breach (Correct answer)
Hiring a new IT security manager
Renewing their SSL certificate
Adding a new point-of-sale terminal

Correct answer: Suspecting a cardholder data breach

Suspected or confirmed cardholder data breaches must be reported to the acquiring bank immediately, regardless of the normal annual compliance reporting schedule.

Question 26: What role does collaboration play in incident response for PCIP professionals?

It slows down work unnecessarily
It enhances outcomes through diverse perspectives and shared expertise (Correct answer)
It reduces individual accountability
It is only needed in emergencies

Correct answer: It enhances outcomes through diverse perspectives and shared expertise

Collaboration leverages diverse perspectives and combined expertise to achieve better outcomes than any individual could alone.

Question 27: What is the primary purpose of network segmentation in the context of PCI DSS?

To replace the need for firewalls on CDE systems
To eliminate the need for encryption of cardholder data in transit
To enable shared user accounts across departments
To reduce the scope of the PCI DSS assessment by isolating the CDE (Correct answer)

Correct answer: To reduce the scope of the PCI DSS assessment by isolating the CDE

Effective network segmentation isolates the CDE from out-of-scope systems, reducing the number of systems subject to PCI DSS requirements and lowering compliance costs.

Question 28: An organization is designing its incident response plan for a cardholder data breach. Which step must occur BEFORE forensic investigation begins?

Containing the breach to prevent further data loss (Correct answer)
Resuming normal payment operations
Notifying the media
Filing a police report

Correct answer: Containing the breach to prevent further data loss

Containment is the critical first technical step to stop ongoing data loss before evidence is collected or other notifications are made.

Question 29: Which of the following best defines the Cardholder Data Environment (CDE) in the context of PCI DSS?

Any system that connects to the internet and processes financial transactions
Only the servers that store primary account numbers (PANs) in encrypted form
The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data (Correct answer)
The network segment that hosts the organization's payment gateway exclusively

Correct answer: The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data

The CDE encompasses all people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, as well as systems connected to or that could impact its security.

Question 30: What is the primary purpose of a demilitarized zone (DMZ) in a PCI DSS-compliant network architecture?

To replace the need for intrusion detection systems
To store cardholder data for easier access by employees
To host public-facing systems while preventing direct access to the internal network and CDE (Correct answer)
To serve as the primary backup location for encryption keys

Correct answer: To host public-facing systems while preventing direct access to the internal network and CDE

A DMZ isolates public-facing components (web servers, payment gateways) from the internal network, preventing attackers who compromise DMZ systems from directly reaching the CDE.

Question 31: What is the significance of CVE (Common Vulnerabilities and Exposures) identifiers in PCI DSS vulnerability management?

CVEs are used to assign CVSS scores to vulnerabilities
CVEs replace the need for internal vulnerability scanning
CVEs provide a standardized reference for publicly known vulnerabilities, aiding in consistent tracking (Correct answer)
CVEs are only relevant to network-layer vulnerabilities

Correct answer: CVEs provide a standardized reference for publicly known vulnerabilities, aiding in consistent tracking

CVE identifiers provide a standardized naming convention for publicly known vulnerabilities, enabling consistent communication and tracking across organizations and tools.

Question 32: Under PCI DSS Requirement 11, after a significant infrastructure change, when must an internal vulnerability scan be performed?

After the next scheduled quarterly scan
After the change is implemented (Correct answer)
Only if the QSA requests it
Within 90 days of the change

Correct answer: After the change is implemented

PCI DSS requires internal vulnerability scans to be performed after any significant changes to the network or system components.

Question 33: Which of the following describes a 'false negative' in the context of PCI DSS security monitoring?

A real attack that occurred but was not detected or alerted on (Correct answer)
A log entry that was improperly formatted by the logging system
An alert triggered by legitimate activity that was flagged as malicious
An incorrectly configured firewall rule that blocks valid traffic

Correct answer: A real attack that occurred but was not detected or alerted on

A false negative occurs when a genuine threat or attack goes undetected, meaning monitoring systems failed to generate an alert for a real incident.

Question 34: What is the primary consideration when implementing changes to network security?

Impact assessment and change management (Correct answer)
Speed of implementation
Vendor preference
Personal convenience

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 35: A service provider manages multiple clients' payment environments. Under PCI DSS, which responsibility does the service provider have regarding its clients' CDE components?

The service provider must assume full PCI DSS responsibility for each client's environment
The service provider must provide clients with a Responsibility Matrix clarifying which PCI DSS requirements it manages versus those the client manages (Correct answer)
The service provider has no obligations for client CDE components it does not directly manage
The service provider must obtain its own QSA certification for each client separately

Correct answer: The service provider must provide clients with a Responsibility Matrix clarifying which PCI DSS requirements it manages versus those the client manages

PCI DSS requires service providers to supply customers with a clear responsibility matrix (or similar document) delineating which PCI DSS controls the provider manages and which remain the client's responsibility.

Question 36: Who must receive the completed ROC and AOC?

Employees
IT department
Public users
Acquiring bank/card brands (Correct answer)

Correct answer: Acquiring bank/card brands

The completed Report on Compliance (ROC) and Attestation of Compliance (AOC) must be submitted to the organization's acquiring bank and/or the relevant card brands (e.g., Visa, Mastercard, American Express). These entities are responsible for enforcing PCI DSS compliance within the payment ecosystem. They use these documents to verify that merchants and service providers are meeting their security obligations.

Question 37: What is the MOST effective way for new PCIP professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Focusing solely on the most advanced topics
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 38: What is the best practice for documenting assessment results in PCIP practice?

Document all findings objectively and completely (Correct answer)
Use subjective descriptions only
Document results from memory at end of day
Record only abnormal findings

Correct answer: Document all findings objectively and completely

Best practice requires documenting all findings objectively and completely at the time of assessment for accuracy and legal protection.

Question 39: Which risk management approach is MOST effective for PCIP professionals when evaluating potential workplace hazards?

Relying solely on historical accident data
Proactive hazard identification and assessment (Correct answer)
Delegating all safety decisions to management
Reactive analysis after incidents occur

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur, which is far more effective than reactive approaches that only address problems after they happen.

Question 40: An attacker gains access to the CDE by exploiting an account that was not disabled after an employee resignation two weeks prior. Which PCI DSS control failure does this represent?

Failure to immediately remove access upon termination per Requirement 8.1.3 (Correct answer)
Failure to encrypt the account credentials in transit
Failure to conduct quarterly vulnerability scans
Failure to implement MFA on the account

Correct answer: Failure to immediately remove access upon termination per Requirement 8.1.3

PCI DSS Requirement 8.1.3 requires immediate removal of access for terminated users — a two-week delay represents a direct violation of this control.

Question 41: Which of the following BEST describes the role of a Security Information and Event Management (SIEM) system in a PCI DSS environment?

It encrypts all log data before storage to meet Requirement 3
It automatically patches vulnerabilities identified in network scans
It replaces the need for firewalls by blocking malicious traffic in real time
It aggregates and correlates log data from across the CDE to detect security events and support forensic investigation (Correct answer)

Correct answer: It aggregates and correlates log data from across the CDE to detect security events and support forensic investigation

A SIEM centralizes logs from CDE systems, correlates events across sources, and generates alerts, directly supporting PCI DSS Requirements 10.4 and 10.7 for log review and retention.

Question 42: Which of the following BEST represents a vulnerability in the context of PCI DSS risk assessment?

An unpatched operating system running on a POS terminal (Correct answer)
The likelihood that an attacker targets the cardholder environment
The financial impact of a data breach
A hurricane that could flood the data center

Correct answer: An unpatched operating system running on a POS terminal

A vulnerability is a weakness in a system, such as an unpatched OS, that a threat could exploit; threats and impacts are separate risk components.

Question 43: What is the MOST important reason for Payment Card Industry Professional professionals to maintain continuing education?

To accumulate credentials for personal prestige
To increase billing rates
To stay current with evolving standards, practices, and regulations (Correct answer)
To satisfy employer preferences

Correct answer: To stay current with evolving standards, practices, and regulations

Continuing education ensures professionals remain current with evolving industry standards, best practices, and regulatory requirements. This directly impacts the quality of service provided and maintains public trust in the profession.

Question 44: Which PCI DSS requirement mandates that anti-malware solutions be kept current and capable of generating audit logs?

Requirement 7
Requirement 5 (Correct answer)
Requirement 3
Requirement 10

Correct answer: Requirement 5

Requirement 5 requires that anti-malware mechanisms be deployed, maintained with current definitions, and configured to generate logs that are retained per organizational policy.

Question 45: What is the most effective approach to vulnerability management in the PCIP field?

Reactive problem-solving
Following competitors
Maintaining the status quo
Systematic planning and continuous improvement (Correct answer)

Correct answer: Systematic planning and continuous improvement

Systematic planning combined with continuous improvement ensures sustainable success and allows for proactive management of challenges.

Question 46: Under PCI DSS, how long must audit logs be retained, and how much must be immediately available for analysis?

2 years total; 6 months immediately available
90 days total; 30 days immediately available
1 year total; 3 months immediately available (Correct answer)
6 months total; 1 month immediately available

Correct answer: 1 year total; 3 months immediately available

PCI DSS requires audit logs to be retained for at least 12 months, with at least the most recent 3 months immediately available for analysis.

Question 47: A service provider stores, processes, or transmits cardholder data on behalf of another entity. What compliance document must they provide to their clients annually?

Attestation of Compliance (AOC) (Correct answer)
PCI DSS Report on Compliance (ROC)
Self-Assessment Questionnaire (SAQ)
Network segmentation penetration test results

Correct answer: Attestation of Compliance (AOC)

Service providers must provide an Attestation of Compliance (AOC) to their clients as evidence of their own PCI DSS compliance status.

Question 48: Which protocol version is explicitly prohibited by PCI DSS 4.0 for protecting cardholder data in transit?

TLS 1.3
TLS 1.2
TLS 1.1
SSL 3.0 (Correct answer)

Correct answer: SSL 3.0

SSL 3.0 (and all SSL versions) are explicitly prohibited by PCI DSS 4.0 due to known vulnerabilities such as POODLE.

Question 49: When scoping the CDE, which category of systems is considered 'connected-to' and therefore in scope?

Only systems that directly process PANs
Any system that has internet connectivity, regardless of network placement
Systems that share a network segment with CDE systems or have unrestricted connectivity to them (Correct answer)
Systems that are on a separate network segment with no direct route to the CDE

Correct answer: Systems that share a network segment with CDE systems or have unrestricted connectivity to them

Systems sharing a network segment with CDE systems or having unrestricted network access to CDE systems are considered in scope because they could impact the security of the CDE.

Question 50: Which PCI DSS document type formally records identified risks, their ratings, owners, and treatment plans?

System Security Plan
Compensating Control Worksheet
Risk Register (Correct answer)
Network Segmentation Diagram

Correct answer: Risk Register

A risk register is the formal document used to track identified risks, their assessed ratings, assigned owners, and planned or completed treatment actions.

Question 51: What is the role of the Forensic Investigator (PFI) in a post-breach scenario under PCI DSS?

To impose fines directly on the breached merchant
To investigate the breach and produce a forensic report for payment brands (Correct answer)
To conduct the next annual QSA assessment on behalf of the breached entity
To update the SAQ on behalf of the merchant

Correct answer: To investigate the breach and produce a forensic report for payment brands

A PCI Forensic Investigator (PFI) is engaged after a breach to investigate, determine root cause, and deliver a forensic report to the requesting payment brand.

Question 52: A merchant discovers a vulnerability that has a patch available but cannot immediately apply it due to operational constraints. What is the PCI DSS-compliant response?

Implement compensating controls and document the risk (Correct answer)
Submit a SAQ indicating the vulnerability is acceptable
Remove the affected system from the network permanently
Ignore the vulnerability until the next scheduled maintenance window

Correct answer: Implement compensating controls and document the risk

When patching is delayed, merchants must implement compensating controls and document the associated risk per PCI DSS guidelines.

Question 53: Which PCI DSS requirement specifically mandates that organizations maintain and implement an incident response plan?

Requirement 8
Requirement 12 (Correct answer)
Requirement 10
Requirement 6

Correct answer: Requirement 12

PCI DSS Requirement 12.10 mandates that organizations implement an incident response plan and be prepared to respond immediately to a system breach.

Question 54: What does a data retention policy define?

Data storage duration (Correct answer)
Application access rules
Network speed requirements
How to format hard drives

Correct answer: Data storage duration

A data retention policy defines how long specific types of data should be kept and when they should be securely disposed of. This policy is crucial for ensuring compliance with legal and regulatory requirements, managing storage costs, and minimizing the risk associated with holding sensitive information longer than necessary. It outlines the complete lifecycle of data from creation to destruction.

Question 55: Under PCI DSS, which action is required when a critical security control such as a firewall fails?

Implement compensating controls and document the failure immediately (Correct answer)
Continue operations normally until the next maintenance window
Notify the card brands within 24 hours
Suspend all card transactions until the control is restored

Correct answer: Implement compensating controls and document the failure immediately

PCI DSS requires that failures of critical security controls be detected promptly and addressed with compensating controls until the primary control is restored.

Question 56: How does the PCIP body of knowledge relate to daily professional practice?

It is theoretical and has limited practical application
It is relevant only for academic research
It only applies during certification exams
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 57: Under PCI DSS v4.0, how frequently must a targeted risk analysis be performed for controls where the entity defines its own frequency?

At least annually (Correct answer)
Each time a significant change occurs
At least once every two years
At least once every three years

Correct answer: At least annually

PCI DSS v4.0 requires that targeted risk analyses be reviewed and updated at least once every 12 months to remain relevant.

Question 58: What cryptographic concept does AES-GCM provide that AES-CBC alone does not?

Authenticated encryption (confidentiality + integrity) (Correct answer)
Public key infrastructure support
Faster key generation
Larger key sizes

Correct answer: Authenticated encryption (confidentiality + integrity)

AES-GCM provides authenticated encryption with associated data (AEAD), offering both confidentiality and integrity/authentication in a single operation.

Question 59: In Payment Card Industry Professional, what is the PRIMARY purpose of conducting regular safety drills and exercises?

To ensure personnel can respond effectively in emergencies (Correct answer)
To reduce daily workload
To evaluate employee performance reviews
To satisfy insurance requirements only

Correct answer: To ensure personnel can respond effectively in emergencies

Regular safety drills ensure that all personnel are prepared to respond effectively during actual emergencies. Practice builds muscle memory, identifies gaps in emergency procedures, and improves overall response times.

Question 60: Which of the following scenarios represents risk AVOIDANCE as a treatment strategy?

Purchasing insurance to cover breach notification costs
Discontinuing a high-risk paper-based order process that captures full PANs (Correct answer)
Encrypting all stored PANs to reduce breach impact
Accepting a low-rated risk after management review

Correct answer: Discontinuing a high-risk paper-based order process that captures full PANs

Risk avoidance eliminates the risk entirely by stopping the activity that creates it, such as discontinuing a risky business process.

Payment Card Industry Professional (PCIP) Certification Exam

The PCIP certification validates an individual's knowledge and understanding of the PCI Data Security Standard (PCI DSS) and its application in securing payment card data.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds