Risk Management & Data Protection Strategies Flashcards

Which data protection technique replaces a PAN with a randomly generated value that has no exploitable relationship to the original, and the mapping is stored in a separate vault?

Answer: Tokenization

Tokenization substitutes the PAN with a surrogate token, with the original PAN stored only in a secure vault, making the token itself valueless if stolen.

A PCIP candidate is reviewing a company's compensating controls worksheet. Which condition MUST be met for a compensating control to be acceptable under PCI DSS?

Answer: It must go above and beyond the intent of the original requirement

PCI DSS requires compensating controls to provide an equivalent or greater level of defense than the original requirement, effectively going above and beyond its intent.

What is the purpose of a Business Impact Analysis (BIA) in the context of payment card data protection?

Answer: To quantify the operational and financial consequences of losing access to critical systems or data

A BIA identifies and quantifies the impact of disruptions to critical business functions, informing recovery time objectives and data protection priorities.

Under PCI DSS, which of the following is classified as Sensitive Authentication Data (SAD) that must NEVER be stored after authorization?

Answer: Card Verification Value (CVV2)

CVV2 (and equivalent codes like CVC2, CID) is classified as SAD and is explicitly prohibited from storage at any point after authorization.

An assessor is evaluating an organization's key management procedures. Which practice demonstrates proper split knowledge for cryptographic keys?

Answer: Two or more people each hold a different component of the key, and no single person can reconstruct it alone

Split knowledge requires dividing a key into components distributed among separate custodians so no individual can reconstruct the key unilaterally.

A retailer's risk register lists 'card skimming on POS terminals' as a high-priority risk. Which control BEST mitigates this threat?

Answer: Performing periodic physical inspection and tamper checks of POS devices

Physical inspection and tamper checks directly address card skimming by detecting unauthorized device modifications or overlays before data can be compromised.

Which PCI DSS requirement category governs the implementation and maintenance of vulnerability management programs?

Answer: Requirement 6 – Develop and maintain secure systems and software

Requirement 6 covers secure development, patch management, and the overall vulnerability management lifecycle for systems and software.