Cardholder Data Environment Flashcards

Which of the following best defines the Cardholder Data Environment (CDE) in the context of PCI DSS?

Answer: The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data

The CDE encompasses all people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, as well as systems connected to or that could impact its security.

Which of the following data elements is considered cardholder data under PCI DSS?

Answer: The Primary Account Number (PAN)

The Primary Account Number (PAN) is cardholder data; the other options describe sensitive authentication data (SAD) that must never be stored post-authorization.

A retailer's point-of-sale terminals transmit cardholder data to a back-office server that then forwards it to an acquirer. Which systems are considered part of the CDE?

Answer: The POS terminals, back-office server, and all systems that could impact their security

PCI DSS defines the CDE to include all systems that store, process, or transmit cardholder data AND any systems that could impact the security of those systems, so all interconnected components are in scope.

Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD)?

Answer: Full track data from the magnetic stripe

Full track data (magnetic stripe or equivalent on a chip) is Sensitive Authentication Data and must never be stored after authorization, unlike PANs, names, or expiration dates, which are cardholder data.

What is the primary purpose of network segmentation when applied to the CDE?

Answer: To reduce the scope of PCI DSS compliance by isolating cardholder data systems

Network segmentation isolates the CDE from other networks, which reduces the number of systems in scope for PCI DSS and can simplify compliance efforts.

Which statement about storing Sensitive Authentication Data (SAD) post-authorization is correct under PCI DSS?

Answer: SAD must never be stored after the authorization process is complete, regardless of encryption

PCI DSS prohibits storing SAD after authorization for all entities — this rule applies regardless of encryption or business need for merchants, service providers, and acquirers.

A company uses a third-party payment processor that handles all cardholder data on its behalf, and the company never touches card data directly. How does this affect the company's PCI DSS scope?

Answer: The company's scope is reduced but it still has PCI DSS obligations related to how it connects to the processor

Outsourcing card processing reduces scope but does not eliminate it; the company is still responsible for ensuring secure connections to the processor and may need to validate compliance via an SAQ.