Risk Management & Data Protection Strategies Flashcards

A merchant discovers that its third-party delivery application is storing full PANs in plaintext log files. Under PCI DSS, which immediate action is the HIGHEST priority?

Answer: Stop the storage of full PANs and delete existing plaintext log data

PCI DSS Requirement 3 prohibits storing sensitive authentication data after authorization; the immediate priority is to cease the prohibited storage and purge existing data.

Which risk treatment option involves transferring the financial consequences of a risk to another party, such as purchasing cyber insurance?

Answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party (e.g., insurer or outsourced vendor) rather than bearing it internally.

Under PCI DSS v4.0, what is the minimum key length required for RSA keys used to protect cardholder data?

Answer: 2048 bits

PCI DSS v4.0 requires RSA keys to be at least 2048 bits to be considered cryptographically strong.

A payment processor uses a hardware security module (HSM) for key management. Which HSM function directly prevents clear-text keys from ever appearing outside the device?

Answer: Key encryption key (KEK) wrapping

A KEK wraps (encrypts) other keys so they can only be exported in encrypted form, ensuring clear-text keys never leave the HSM boundary.

An organization wants to reduce its PCI DSS scope by routing all cardholder data through a third-party tokenization service. Which outcome correctly describes the scope reduction?

Answer: Systems that only handle tokens and never see PANs can be considered out of scope

Systems that handle only irreversible tokens and have no access to the PANs or the token vault can be excluded from PCI DSS scope.

During a risk assessment, the likelihood of a SQL injection attack is rated 'High' and the impact is rated 'High.' According to a standard risk matrix, what is the resulting risk level?

Answer: Critical

A High likelihood combined with High impact produces a Critical (or highest-tier) risk rating on a standard 4×4 or 5×5 risk matrix.

PCI DSS Requirement 12.3 mandates that organizations perform a targeted risk analysis for certain customized controls. What must this analysis include?

Answer: Identification of the assets being protected, the threats, and the likelihood and impact of each threat

PCI DSS v4.0 requires targeted risk analyses to document assets, threats, and the likelihood and impact of exploitation to justify customized implementations.