Risk Assessment Flashcards

During a PCI DSS risk assessment, which threat modeling approach focuses on identifying assets, threats, vulnerabilities, and countermeasures?

Answer: OCTAVE

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is an asset-driven threat modeling approach widely used in PCI DSS risk assessments.

A risk assessment identifies that a third-party vendor stores cardholder data. Under PCI DSS, what is the PRIMARY responsibility of the assessed entity?

Answer: Ensure the vendor is PCI DSS compliant and monitor their compliance

The assessed entity must ensure third-party service providers are PCI DSS compliant and maintain ongoing monitoring of their compliance status.

Which PCI DSS requirement mandates that a formal risk assessment be performed at least annually?

Answer: Requirement 12

PCI DSS Requirement 12.3 requires that a risk assessment be performed at least annually and upon significant changes to the environment.

When assessing residual risk after controls are applied, which formula best represents the calculation?

Answer: Residual Risk = Inherent Risk − Control Effectiveness

Residual risk is the remaining risk after subtracting the risk reduction achieved by implemented controls from the inherent risk.

A PCIP professional is reviewing a risk assessment that categorizes risks as High, Medium, or Low. This approach is BEST described as:

Answer: Qualitative risk analysis

Qualitative risk analysis uses descriptive categories (High/Medium/Low) rather than numerical monetary values to rank risks.

Which of the following is a key input required BEFORE conducting a PCI DSS scoped risk assessment?

Answer: Accurate network diagram and data flow diagram

Accurate network and data flow diagrams are essential prerequisites to properly define scope and identify cardholder data flows before risk assessment.

During risk assessment, a business unit argues that compensating controls fully eliminate a known vulnerability. As a PCIP, your BEST response is:

Answer: Verify the compensating controls meet all PCI DSS criteria and still document the residual risk

Compensating controls must meet specific PCI DSS criteria, and residual risk should still be documented even when compensating controls are accepted.