Risk Management & Data Protection Strategies Flashcards

An e-commerce organization implements point-to-point encryption (P2PE) using a PCI-validated P2PE solution. What is the PRIMARY scope reduction benefit?

Answer: Merchant systems that only handle encrypted data and cannot decrypt it may be removed from CDE scope

A validated P2PE solution encrypts card data at the point of interaction, so merchant systems that handle only ciphertext and cannot decrypt it can be excluded from the cardholder data environment.

What does the term 'residual risk' mean in a payment security risk management program?

Answer: The risk that remains after all planned controls have been applied

Residual risk is the level of risk that persists after existing or planned controls have been applied, which management must then accept, transfer, or further mitigate.

A payment organization must restrict access to cardholder data to only those individuals whose job function requires it. Which security principle does this BEST represent?

Answer: Need to know

The need-to-know principle limits data access to individuals whose specific role requires that information, directly aligning with PCI DSS Requirement 7.

Under PCI DSS v4.0, how frequently must a targeted risk analysis be performed for controls where the entity defines its own frequency?

Answer: At least annually

PCI DSS v4.0 requires that targeted risk analyses be reviewed and updated at least once every 12 months to remain relevant.

Which attack specifically targets the cardholder data environment by intercepting network traffic to capture PANs transmitted in cleartext between systems?

Answer: Packet sniffing (network eavesdropping)

Packet sniffing captures unencrypted network packets, making cleartext PAN transmissions visible to an attacker with network access.

An organization is designing its incident response plan for a cardholder data breach. Which step must occur BEFORE forensic investigation begins?

Answer: Containing the breach to prevent further data loss

Containment is the critical first technical step to stop ongoing data loss before evidence is collected or other notifications are made.

PCI DSS Requirement 8 addresses authentication. Which of the following is an example of multi-factor authentication (MFA) as defined by PCI DSS?

Answer: A PIN plus a one-time passcode sent to a registered mobile device

MFA requires at least two independent factors from different categories (something you know, something you have, something you are), such as a PIN plus an OTP token.